cybr.cx — Daily Digest | September 16, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-76461 | Cisco Secure Email Gateway | No CVSS in NVD feed
A SQL injection vulnerability in Cisco AsyncOS allows an unauthenticated remote attacker to execute arbitrary OS commands with root privileges on Cisco Secure Email Gateway appliances. CISA added this on September 14 with a remediation deadline of yesterday — if you haven't patched, treat this as on fire. No authentication required; network-accessible exploitation makes this trivially weaponisable at scale.

⚠️ Actively exploited — CVE-2026-87491 | Google Chromium V8
An out-of-bounds write in Chromium's V8 JavaScript engine allows a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. This affects Chrome, Edge, and any Chromium-based browser — essentially every enterprise desktop. Drive-by delivery is the obvious threat vector; push browser updates now and don't wait for your monthly cycle.

⚠️ Actively exploited — CVE-2026-85706 | GitLab Community & Enterprise Edition
An unauthenticated path traversal in GitLab's repository commits API allows arbitrary file reads without authentication, even on instances with auth enforced. Source code, secrets, CI/CD credentials, and private keys are all in scope. GitLab is frequently internet-facing; check your exposure immediately.

⚠️ Actively exploited — CVE-2026-42016 & CVE-2026-42018 | JFrog Artifactory
Two concurrent Artifactory flaws, both KEV-listed. CVE-2026-42016 allows privilege escalation because token validation checks the signature/issuer but not the token's scope — crafted tokens can gain elevated access. CVE-2026-42018 can return an internal anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Together they form a dangerous pair in any environment using Artifactory as a package registry. Deadline: September 25.

⚠️ Actively exploited — CVE-2026-84869 | ConnectWise ScreenConnect
Missing authorisation in ScreenConnect allows an attacker to perform file transfers and execute files through active remote sessions without host confirmation or authorisation. RMM tools have been a favoured pivot point for ransomware operators; this one requires no prior auth on the session. CISA's due date has already passed (September 14) — verify your ScreenConnect version immediately.

⚠️ Actively exploited — CVE-2026-19490 | Citrix NetScaler ADC & Gateway
Authentication bypass via an alternate channel affects NetScaler when configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Unauthenticated remote attackers can bypass authentication outright. Citrix NetScaler bugs have historically been among the fastest-exploited enterprise vulnerabilities; treat this as critical regardless of your patch schedule. CISA deadline was September 12 — you're already late.

⚠️ Actively exploited — CVE-2026-86060 & CVE-2026-67277 | MikroTik RouterOS
Two RouterOS flaws under active exploitation: CVE-2026-86060 allows argument-delimiter injection to manipulate trusted policy masks and escalate privileges; CVE-2026-67277 exposes kernel memory and enables denial of service via the unauthenticated btest service. MikroTik devices are everywhere in SMB and ISP infrastructure and are historically slow to patch. Both CISA deadlines have passed.

⚠️ Actively exploited — CVE-2026-20079 | Cisco Secure Firewall Management Center & Security Cloud Control
Authentication bypass via alternate path allows unauthenticated remote attackers to bypass login and execute scripts on Cisco FMC and SCC. Management plane compromise of firewall infrastructure is as bad as it gets — an attacker here owns your network policy. CISA deadline was September 12.

⚠️ Actively exploited — CVE-2025-25249 | Fortinet FortiOS, FortiSwitchManager, FortiSASE
A heap-based buffer overflow allows attackers to execute unauthorised code or commands via specially crafted packets. Fortinet edge devices are perennial targets; this one affects three separate product lines simultaneously. Patch or isolate management interfaces now.

⚠️ Actively exploited — CVE-2026-81963 & CVE-2026-85880 | Microsoft Windows
Two Windows local privilege escalation bugs under active exploitation. CVE-2026-81963 is a link-following vulnerability in the Windows Update Stack leading to SYSTEM. CVE-2026-85880 is a heap-based buffer overflow in ALPC, also escalating to SYSTEM. Both are classic post-exploitation primitives — expect to see these chained with initial access bugs in ransomware and espionage campaigns.

⚠️ Actively exploited — CVE-2026-86218 | N-able N-central
A static code injection vulnerability enables pre-authentication RCE on N-able N-central, another RMM platform. Like ScreenConnect, compromising an RMM gives attackers downstream access to every managed endpoint. CISA deadline was September 11 — this is overdue.

⚠️ Actively exploited — CVE-2026-75650 | Adobe Commerce & Magento Open Source
Template engine injection in Adobe Commerce and Magento allows arbitrary code execution. E-commerce platforms remain high-value targets for skimming and data theft; this one is unauthenticated and remotely exploitable. CISA deadline was September 11.

CVE-2026-83304 | Oracle Business Intelligence Enterprise Edition | CVSS 8.9
A network-accessible HTTP flaw affecting Oracle BIEE versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 allows unauthenticated compromise. Rated "difficult to exploit" by Oracle, but the attack surface is broad given how widely BIEE is deployed in enterprise analytics environments. Patch during your next maintenance window.

CVE-2026-70915 / CVE-2026-71047 / CVE-2026-73942 | Oracle Identity Manager | CVSS 8.8
Three separate takeover-level vulnerabilities in Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0), exploitable by low-privileged network attackers via T3/IIOP and HTTP. An IAM platform compromise is a skeleton-key scenario — treat these as priority patches regardless of internal-only access assumptions.

CVE-2026-91964 | FreeRDP < 3.31.0 | CVSS 8.8
A heap-based buffer overflow in FreeRDP's negotiation request handler allows a malicious RDP server to overflow a fixed 512-byte buffer with an arbitrarily-sized LoadBalanceInfo field, causing crashes or potential RCE on connecting clients. Relevant anywhere FreeRDP is used as an RDP client — including many Linux and embedded environments. Update to 3.31.0.

Headline News

A single threat actor linked to supply chain attacks across OpenAI, Anthropic, and Meta
Investigators have traced a coordinated series of intrusions — targeting AI laboratory infrastructure at OpenAI, Anthropic, and Meta — back to a single organisation operating across all three incidents. The attacks appear designed to extract model weights, training data, and internal research rather than pursue conventional financial motives, suggesting state-adjacent or well-resourced commercial espionage. The RubyGems ecosystem was also implicated: over 2,000 packages were uploaded in a 48-hour window in May 2026, with research linking the campaign to the same actor using OpenAI testing agents to automate package creation and poisoning at scale. For practitioners, this is a significant escalation — supply chain attacks are now being executed with AI-assisted tooling, dramatically lowering the cost of volume poisoning. Security teams maintaining Ruby-based pipelines should audit recently-added dependencies against the May 2026 upload window and review integrity verification controls.

America's driver's licence breach: a national security reckoning
A large-scale breach of US driver's licence data has emerged as a national security concern, with analysis indicating that the scope and nature of the exposed records go well beyond typical identity theft risk. Driver's licence databases contain name, address, physical descriptors, and date of birth — the foundational identity layer used for background checks, employment vetting, border processing, and law enforcement lookups. At the scale now being discussed, the data provides foreign intelligence services with a near-comprehensive identity map of the American adult population, enabling targeted recruitment, covert travel, and social engineering operations against cleared personnel. This is not a breach with a credit-freeze remedy — the data cannot be changed, and its utility to adversaries is permanent. Security teams supporting cleared facilities and critical infrastructure should reassess identity verification procedures that rely on government-ID matching as a trust anchor.

Japan's Digital Agency confirms 246,000 personnel records exposed via VPN flaw
Japan's Digital Agency has disclosed that a vulnerability in a VPN product exposed approximately 246,000 rows of government employee personal data, including details sufficient to identify individual civil servants across multiple agencies. The breach underscores the persistent risk of network-perimeter appliances serving as the soft underbelly of otherwise hardened government infrastructure — a pattern that has played out repeatedly across Western governments in recent years. With multiple VPN and edge-device CVEs appearing in this week's KEV additions alone (Citrix, Fortinet, MikroTik), the message for public sector network teams is unambiguous: edge appliances require the same — or higher — patch urgency as internet-facing application servers. Personnel data from government agencies carries compounding risk; it enables targeted phishing, insider threat recruitment, and correlates directly with cleared or sensitive-access staff populations.

Schrödinger's Feed

Oracle Java 27 is shipping native support for post-quantum hybrid key exchange in TLS 1.3, combining classical ECDH with NIST-standardised PQC algorithms to protect connections against harvest-now-decrypt-later attacks. This is a meaningful inflection point: Java powers an enormous proportion of enterprise backend services, and native PQC support in the runtime removes one of the primary friction points for adoption — teams no longer need to bolt on third-party libraries or wait for framework updates. The hybrid approach is the right call for this transition period, maintaining classical security guarantees while adding quantum resistance. Practitioners running Java-based services that handle long-lived sensitive data — financial records, health data, classified comms — should begin evaluating Java 27 migration timelines now; "we'll get to PQC eventually" is becoming a harder position to defend as mainstream runtimes ship it by default.

/dev/random

This week's strangest submission to the practitioner community was an AI-powered 3D modelling tool called Cartesian, which generates parametric design geometry from natural language prompts. Innocuous enough — until you consider that the same prompt-to-geometry pipeline, pointed at physical security hardware like enclosures, server chassis, or access-control housings, could accelerate the design of convincing replicas for social engineering or bypass purposes. Nobody is suggesting that's the intended use case, and the tool itself appears entirely benign. But as AI collapses the skill gap in physical fabrication the same way it has in code generation, "security through obscurity of form factor" is quietly becoming another assumption worth revisiting. At minimum, it's a good excuse to finally get a 3D printer on the red team budget request.