cybr.cx Daily Digest — September 18, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-76461 | Cisco Secure Email Gateway | No CVSS in NVD yet (KEV-listed)
An unauthenticated attacker can send a specially crafted email to exploit a SQL injection flaw in Cisco AsyncOS, escalating all the way to root on the underlying OS. No credentials required. CISA's patch deadline has already passed (September 17) — if you haven't applied the fix, treat this as an emergency. The active exploitation in the wild makes this the highest-priority item in today's digest.

⚠️ Actively exploited — CVE-2026-76460 | Cisco Identity Services Engine | KEV-listed
An unauthenticated remote attacker can bypass ISE's entire web management interface by abusing a privileged API incorrectly exposed to the network. Given ISE's role as a network access control chokepoint, compromise here means lateral movement across the environment is trivially within reach. CISA deadline is September 19 — patch today.

⚠️ Actively exploited — CVE-2026-58704 | Google Pixel (cellular modem) | KEV-listed
A logic error in the Pixel cellular modem's authorization layer lets an attacker bypass permission checks and escalate privileges — likely exploitable over the radio interface without user interaction. This class of modem-level vulnerability is particularly dangerous on devices carried by executives, journalists, and government staff. CISA deadline is September 19; apply the OTA update immediately.

⚠️ Actively exploited — CVE-2026-87886 | Acronis Backup (cPanel/WHM & Plesk plugin) | KEV-listed
Incorrect default permissions in the Acronis Backup plugin allow privilege escalation on servers running cPanel or Plesk. Hosting providers and managed service providers are the primary exposure here — a compromised backup agent on a shared host has devastating blast radius. CISA deadline is September 19.

⚠️ Actively exploited — CVE-2026-85706 | GitLab CE/EE | KEV-listed
An unauthenticated path traversal in GitLab's repository commits API allows arbitrary file reads from the server — no login required. Source code, secrets, CI/CD credentials, and SSH keys stored on the instance are all reachable. Patch or restrict external access immediately; exploitation is confirmed in the wild.

⚠️ Actively exploited — CVE-2026-42016 & CVE-2026-42018 | JFrog Artifactory | KEV-listed
Two flaws hitting Artifactory simultaneously: one lets an attacker escalate privileges by exploiting token validation that checks signature but ignores scope; the other can leak an internal anonymous-user token to unauthenticated callers even when anonymous access is disabled. Together they create a near-trivial path to sensitive artifact access. Both carry a CISA deadline of September 25 — don't wait.

⚠️ Actively exploited — CVE-2026-86060 & CVE-2026-67277 | MikroTik RouterOS | KEV-listed
Two active RouterOS exploits: CVE-2026-86060 allows policy mask manipulation leading to privilege escalation via argument delimiter injection; CVE-2026-67277 exposes kernel memory and enables denial of service through the unauthenticated btest service. MikroTik's ubiquity in ISP and enterprise edge environments makes these high-value targets. Both deadlines have passed — patch now.

⚠️ Actively exploited — CVE-2026-84869 | ConnectWise ScreenConnect | KEV-listed
An attacker can transfer and execute arbitrary files through an active remote session without host confirmation or proper authorization. Remote management tools are prized footholds; this effectively turns ScreenConnect into an unapproved remote execution channel. Patch or isolate ScreenConnect instances facing the internet immediately.

CVE-2026-92748 | BC Security Empire C2 | CVSS 8.8
Authenticated operators in Empire's C2 framework can write files to arbitrary paths on the server via path traversal in multipart upload filenames — leading directly to remote code execution on the C2 infrastructure itself. Red teams and pen test shops running Empire should update to 6.7.1 before their tooling becomes the vulnerability.

CVE-2026-92761 | WebVirtCloud | CVSS 8.8
Read-only users can power off VMs, reset root passwords, and inject SSH keys by exploiting the get_instance permission gate, which only verifies grant existence rather than grant type. Any multi-tenant WebVirtCloud deployment should be considered compromised until patched.

CVE-2026-92796 | Manticore Search 27.x–28.4.3 | CVSS 8.8
Read-only database users can piggyback additional SQL statements onto permitted queries to read credential tables and extract password hashes. This breaks the security model of any application relying on Manticore's access controls. Upgrade to 28.4.4.

Headline News

Cisco Email Gateway Under Active Exploitation via SQL Injection
Attackers are actively exploiting a SQL injection vulnerability in Cisco's Secure Email Gateway — delivering malicious payloads via crafted email messages that manipulate the underlying database and ultimately execute arbitrary commands as root on the OS. The attack vector is particularly alarming because it requires no authentication and arrives through the channel that email security appliances are specifically designed to protect. Defenders should check for anomalous process execution originating from the email scanning service and audit outbound connections from gateway hosts. Cisco has released patches, and CISA's deadline for federal agencies has already elapsed, signalling the urgency applies equally to the private sector. This is one of several Cisco vulnerabilities disclosed this cycle, with AI-assisted internal review credited for uncovering some of the additional flaws — an increasingly common pattern in vendor security engineering.

Iranian State Hackers Deploy CHOSEN BRICK Malware Against Dissidents and Journalists
Government agencies are tracking an Iranian state-linked campaign deploying a previously undocumented Windows malware strain designated CHOSEN BRICK, targeting dissidents, activists, and journalists operating outside Iran's borders. The malware is designed for persistent surveillance, and its targeting profile — civil society rather than infrastructure — suggests the goal is political suppression rather than financial gain or sabotage. For enterprise defenders, the practical concern is the inevitable spillover: campaigns targeting high-risk individuals frequently compromise the organisations, law firms, and NGOs those individuals interact with. Security teams supporting at-risk communities or working in adjacent sectors should review endpoint telemetry for indicators and ensure privileged communications are handled over hardened, air-gapped or strongly-encrypted channels. Nation-state tooling aimed at soft targets frequently precedes broader escalation.

BambooToken Malware Hides C2 Traffic Inside MQTT
Researchers have exposed BambooToken, a stealthy malware family that routes command-and-control traffic over MQTT — the lightweight publish/subscribe protocol ubiquitous in IoT and industrial control systems — allowing it to blend into environments where MQTT traffic is expected and rarely inspected. The malware also leverages DLL sideloading for initial execution, a reliable technique for evading endpoint controls. Active infections have been observed across Asia, though the infrastructure suggests broader ambitions. For defenders, this is a reminder that protocol-level anomaly detection matters: MQTT traffic originating from workstations or servers that have no legitimate IoT function should be treated as an immediate red flag. Network monitoring rules that flag unexpected MQTT broker connections on port 1883 or 8883 are worth adding now.

Schrödinger's Feed

A QuTech spinout, now rebranded as Falqon Systems, is moving beyond hardware manufacturing to deploy end-to-end Quantum Secure Networks — purpose-built infrastructure designed to resist both classical and quantum-capable adversaries. The pivot from component supplier to network operator is significant: it signals that at least some in the industry believe quantum-safe networking is close enough to production-ready to commercialise seriously. For practitioners, the relevant question isn't whether your organisation will buy a quantum network tomorrow, but whether the cryptographic assumptions baked into your long-lived infrastructure — VPNs, PKI, TLS certificates — will still hold in five years. Watching companies like Falqon move from lab to deployment is the clearest leading indicator of how fast that timeline is compressing.

/dev/random

TSMC is preparing to reveal architectural details of its next-generation A14 process node at a major industry conference, and the semiconductor community is predictably excited — but the security angle is quietly interesting too. Process node transitions historically introduce new microarchitectural behaviours, and microarchitectural behaviours have a habit of becoming side-channel attacks two or three research cycles later (see: every Spectre/Meltdown variant ever). The smaller the geometry, the stranger the timing characteristics, the more creative the eventual exploit paper. Consider this your early heads-up to start following the A14 literature now, so you're not scrambling when the first "we found a thing in the new chip" preprint drops.