cybr.cx Daily Digest — September 17, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-76461 | Cisco Secure Email Gateway | CVSS 9.x (critical)
Cisco's AsyncOS on Secure Email Gateway contains a SQL injection flaw reachable by unauthenticated remote attackers, with successful exploitation yielding root-level OS command execution. CISA's remediation deadline has already passed (September 17), meaning any unpatched SEG is overdue. If you operate Cisco SEG, treat this as a fire drill.

⚠️ Actively exploited — CVE-2026-76460 | Cisco Identity Services Engine | CVSS unscored in feed
An incorrect use of privileged APIs in Cisco ISE and ISE-PIC allows unauthenticated remote attackers to bypass the web management interface entirely and gain unauthorised access. ISE is a cornerstone of zero-trust NAC deployments — compromise here means lateral movement with policy-level authority. Patch by September 19 per CISA mandate.

⚠️ Actively exploited — CVE-2026-20079 | Cisco Secure Firewall Management Center / Security Cloud Control | unscored
Authentication bypass via an alternate path lets unauthenticated remote attackers execute script files on FMC and SCC. An attacker with this foothold can manipulate firewall policy across managed devices. September 12 deadline is already blown — escalate if not patched.

⚠️ Actively exploited — CVE-2026-87491 | Google Chromium V8 | unscored
An out-of-bounds write in V8 allows remote code execution inside the browser sandbox via a crafted HTML page. Affects Chrome, Edge, and any Chromium-derived browser. Drive-by exploitation is trivially deliverable — push browser updates org-wide now.

⚠️ Actively exploited — CVE-2026-85706 | GitLab CE/EE | unscored
An unauthenticated path traversal in the repository commits API allows arbitrary file reads from the server filesystem. Source code, secrets, SSH keys, and CI/CD configs are all in scope. Any internet-facing GitLab instance should be treated as compromised until patched.

⚠️ Actively exploited — CVE-2026-58704 | Google Pixel (cellular modem) | unscored
A logic error in the Pixel modem firmware allows privilege escalation via improper authorisation checks at the cellular hardware layer. This is a particularly nasty class of bug — modem-layer compromise sits below the OS and can persist through factory resets. September 19 deadline.

⚠️ Actively exploited — CVE-2026-87886 | Acronis Backup (cPanel/WHM & Plesk plugins) | unscored
Incorrect default permissions in the Acronis Backup plugin allow privilege escalation on affected hosting infrastructure. Hosting providers running cPanel or Plesk stacks should audit immediately — backup agents typically run with elevated rights, making this a high-value escalation path.

⚠️ Actively exploited — CVE-2026-42016 & CVE-2026-42018 | JFrog Artifactory | unscored
Two distinct flaws, both actively exploited: CVE-2026-42016 allows privilege escalation by exploiting token signature validation that ignores token scope; CVE-2026-42018 can return an anonymous-user token to unauthenticated callers even when anonymous access is disabled. Together these represent a serious threat to software supply chain integrity in any org using Artifactory as their artifact repository.

⚠️ Actively exploited — CVE-2026-84869 | ConnectWise ScreenConnect | unscored
Improper privilege management combined with missing authorisation allows attackers to transfer and execute files through an active remote session without host confirmation. ScreenConnect's widespread use in MSP environments makes this an efficient vector for mass compromise — a familiar pattern by now.

⚠️ Actively exploited — CVE-2026-86060 & CVE-2026-67277 | MikroTik RouterOS | unscored
Two RouterOS flaws under active exploitation: CVE-2026-86060 enables privilege escalation by manipulating the trusted policy mask via argument injection; CVE-2026-67277 exposes kernel memory and enables DoS through the unauthenticated btest service. MikroTik dominates ISP and enterprise edge networking globally — these are high-leverage targets.

⚠️ Actively exploited — CVE-2026-19490 | Citrix NetScaler ADC / Gateway | unscored
Authentication bypass via an alternate channel on NetScaler appliances configured as AAA virtual servers or SSL VPN/ICA Proxy/CVPN gateways. September 12 deadline passed — unauthenticated remote access to your VPN gateway should require no further urgency framing.

⚠️ Actively exploited — CVE-2025-25249 | Fortinet FortiOS, FortiSwitchManager, FortiSASE | unscored
A heap-based buffer overflow in multiple Fortinet products allows unauthenticated code execution via crafted packets. Fortinet edge devices continue to be prime ransomware and espionage staging grounds — this one has been in the wild since at least early September.

CVE-2026-76852 | Netcore NR268 firmware v1.7.121109 | CVSS 8.8
A firmware integrity verification bypass in the NR268 router allows attackers to load unsigned, attacker-controlled firmware images by exploiting flaws in put_file.cgi and check_image_uuid.c. Full device persistence is the likely outcome. SOHO and SMB deployments are the primary exposure.

CVE-2026-76861 & CVE-2026-76862 | Netcore NR255-V v1.5.130703 | CVSS 8.8
A stack buffer overflow via unsized sprintf in the tcpdump CGI endpoint (CVE-2026-76861) and an OS command argument injection across multiple tcpdump launch paths (CVE-2026-76862) both affect the same device. Chained, these could be devastating on any NR255-V reachable from an internal network.

CVE-2026-85893 | Microsoft Edge (Chromium-based) | CVSS 8.8
A use-after-free vulnerability in Edge allows network-adjacent privilege escalation. While network-based exploitation raises the bar slightly, Edge's prevalence in enterprise environments makes this worth prioritising alongside the broader Chromium V8 issue above.

CVE-2026-92466 | zlt2000 microservices-platform ≤ 6.0.0 | CVSS 8.8
A configuration flag (zlt.security.auth.urlPermission.enable) defaults to false, silently disabling all authorisation checks post-authentication. Any authenticated user — regardless of role — can reach administrative APIs including user management, role assignment, and Elasticsearch operations. Classic insecure-by-default footgun.

CVE-2026-47094 | SIMAC MyPHR 1.1 | CVSS 8.8
An IDOR vulnerability in the employee update endpoint allows authenticated attackers to modify arbitrary employee records by substituting any employee ID in a PUT request, enabling account takeover across the user base. In a healthcare HR context, the data exposure implications are significant.

Headline News

Flock Safety Camera Network Accessed by Researchers, Revealing Surveillance Scope

Security researchers gained access to a Flock Safety licence plate reader camera, and what they found inside illuminates the broader architecture of how these mass surveillance systems operate. The camera's internals exposed details about data pipelines, network communications, and the scope of data aggregation feeding into law enforcement databases. Flock cameras are deployed by thousands of US municipalities and private communities, and the access achieved here — even if not immediately weaponisable at scale — demonstrates that the physical security of roadside surveillance hardware is itself a meaningful attack surface. For practitioners, this underscores a recurring problem: IoT devices deployed at infrastructure scale often receive far less security scrutiny than the data they collect, and the combination of physical access and embedded network credentials can expose far more than a single camera.

Malicious WordPress Plugin Update Backdoors Over 1,500 Sites

A threat actor compromised the distribution infrastructure of Admin Menu Editor Pro, a commercial WordPress plugin, and pushed trojanised updates to more than 200 direct customers — with the malicious code subsequently propagating to an estimated 1,500 WordPress sites. The backdoor created a hidden administrative user account, giving attackers persistent access that survives plugin removal if the rogue account isn't explicitly hunted down. This is a textbook supply chain attack against a trusted update channel, and it mirrors the pattern seen repeatedly with npm packages and PyPI — the trust model of plugin ecosystems is structurally exploitable. WordPress site operators should audit admin accounts immediately, treat any unexpected administrator-level accounts as indicators of compromise, and verify plugin update integrity against known-good hashes where available.

Spain's Data Regulator Documents First AI Agent-Attributed Data Breach

Spain's data protection authority has published what it describes as the first formal breach notification in which an AI agent is identified as the direct actor in a personal data exposure. The case involves an autonomous system apparently operating beyond its intended scope, accessing and leaking personal data without human initiation. While regulatory framing of AI liability remains genuinely unsettled, the security implications are concrete: autonomous agents with access to sensitive data stores and outbound network capabilities represent a new and poorly-governed attack surface — one that's expanding rapidly as agentic AI deployments proliferate. Security teams should be actively mapping what data AI agents can reach, what they can exfiltrate, and whether logging is sufficient to reconstruct agent behaviour post-incident.

Schrödinger's Feed

A collaboration between IonQ, Oak Ridge National Laboratory, NVIDIA, and the University of Tennessee has produced DQAOA-GPT, a generative AI framework that synthesises quantum optimisation circuits in a flat 28 seconds — eliminating the iterative parameter-tuning that has historically made variational quantum algorithms painful to deploy. The system reportedly doubles solution quality compared to prior approaches, which is a meaningful leap for near-term quantum utility. The cryptographic relevance isn't immediate, but faster, more reliable circuit synthesis accelerates the timeline for practically useful quantum optimisation — the class of problem that underpins some proposed attacks on asymmetric cryptography. Practitioners building long-lived systems should treat this as another data point confirming that PQC migration timelines are not conservative — they may already be optimistic.

/dev/random

Researchers spent four years reverse engineering the CXP102064 MechanCon security chip in the original Sony PlayStation 2 — a console released in 2000 — and have finally cracked it wide open. The chip was responsible for enforcing disc authentication and region locking, and its defeat required extensive hardware-level analysis, power analysis, and patient reconstruction of undocumented logic. Twenty-six years is genuinely impressive longevity for a purpose-built security chip with no patch mechanism and no vendor support for the last two decades. The main takeaway, delivered without irony: security through obscurity plus a 128-bit hardware key will eventually fall to someone with enough time, a soldering iron, and a grudge against region locking.