cybr.cx Daily Digest — September 19, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-76460 | Cisco Identity Services Engine | CVSS: N/A (KEV)
An unauthenticated remote attacker can bypass the web-based management interface of Cisco ISE and ISE-PIC entirely through incorrect use of privileged APIs — no credentials required. ISE is the backbone of network access control in many enterprise environments, making this a high-priority target for initial access. CISA's remediation deadline has already passed (September 19); if you haven't patched, assume exposure.

⚠️ Actively exploited — CVE-2026-76461 | Cisco Secure Email Gateway | CVSS: N/A (KEV)
A SQL injection flaw in Cisco AsyncOS allows an unauthenticated remote attacker to execute arbitrary OS commands with root privileges. Email gateways sit at a high-trust perimeter position and are attractive targets for persistence and interception. Root-level RCE with no authentication is about as bad as it gets — patch or isolate immediately.

⚠️ Actively exploited — CVE-2026-85706 | GitLab CE/EE | CVSS: N/A (KEV)
An unauthenticated path traversal in GitLab's repository commits API allows arbitrary file reads from the server. Source code, secrets, CI/CD configurations, and deployment keys are all potentially exposed without a single login attempt. Self-hosted GitLab instances are the primary concern; update to a patched version now.

⚠️ Actively exploited — CVE-2026-84869 | ConnectWise ScreenConnect | CVSS: N/A (KEV)
An improper privilege management and missing authorisation flaw allows an attacker to transfer and execute files through an active remote session without host confirmation. ScreenConnect has been a persistent target for ransomware operators; this variant requires no extra authorisation to weaponise an existing session. MSPs with broad ScreenConnect deployments should treat this as critical.

⚠️ Actively exploited — CVE-2026-42016 & CVE-2026-42018 | JFrog Artifactory | CVSS: N/A (KEV)
Two separate Artifactory flaws are being exploited in tandem. CVE-2026-42016 allows privilege escalation by validating token signatures without checking scope; CVE-2026-42018 can return an anonymous-user token to unauthenticated callers even when anonymous access is explicitly disabled. Together, these create a clear path from zero access to privileged repository control — a supply chain attacker's toolkit.

⚠️ Actively exploited — CVE-2026-87886 | Acronis Backup (cPanel/Plesk plugin) | CVSS: N/A (KEV)
Incorrect default permissions in the Acronis Backup plugin allow local privilege escalation. Backup agents typically run with elevated rights, making this a reliable post-exploitation step. Hosting environments running cPanel or Plesk at scale should audit plugin permissions urgently.

⚠️ Actively exploited — CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 | Linux Kernel | CVSS: N/A (KEV)
Three Linux Kernel vulnerabilities were added to CISA KEV on September 18 with a three-day remediation window expiring September 21. CVE-2025-39964 is a race condition in AF_ALG sockets causing unpredictable state corruption; CVE-2026-53266 is an out-of-bounds write in ebtables SNAT that can corrupt splice-imported file pages; CVE-2025-39682 is a TLS receive-path flaw that allows zero-length records to bypass record-type handling. Any Linux-based infrastructure — which is most infrastructure — should be prioritising kernel updates this weekend.

⚠️ Actively exploited — CVE-2026-58704 | Google Pixel (Cellular Modem) | CVSS: N/A (KEV)
A logic error in the Pixel cellular modem's permission checks allows privilege escalation — a class of vulnerability associated with targeted surveillance toolchains. The September 19 remediation deadline lands today. If your organisation manages a Pixel fleet, push the patch now; if you're in a high-risk role, treat unpatched devices as compromised.

CVE-2026-84070, CVE-2026-84074, CVE-2026-84106 | IBM Guardium Data Protection 12.2 | CVSS: 8.9
Three near-identical XSS-to-RCE flaws in IBM Guardium allow a remote authenticated attacker to execute arbitrary code via improper input neutralisation during web page generation. Guardium protects sensitive data stores — RCE on the platform monitoring your databases is a serious integrity and confidentiality risk. Apply IBM's patches and review access logs for unusual authenticated activity.

CVE-2026-81942 | PLANET IGS-5225-8P2T4S Industrial Switch | CVSS: 8.8
OS command injection in the web interface of this industrial managed switch passes user input directly to system(), allowing an authenticated attacker to escalate to root. Industrial network switches in OT/ICS environments are often under-patched and over-trusted. Upgrade to firmware 1.2412b260707 (V1) or 2.2412b260519 (V2) and restrict management interface access to trusted hosts.

CVE-2026-10575, CVE-2026-11375, CVE-2026-11378 | IBM MQ | CVSS: 8.8
Three buffer overflow and integer overflow vulnerabilities in IBM MQ affect MQPUT distribution header processing, XA transaction identifier handling, and distribution list processing respectively. An authenticated attacker could achieve denial of service or arbitrary code execution. IBM MQ underpins financial messaging and enterprise integration pipelines — patch promptly and review queue manager exposure.

Headline News

Plugin4Shell: Zero-Click RCE Hits All Four Major AI Coding Agents

A newly disclosed attack chain dubbed "Plugin4Shell" demonstrates zero-click remote code execution affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini — all four dominant AI coding agents simultaneously. The attack works as an AI supply-chain exploit: a trusted plugin is silently swapped for a malicious counterpart and auto-installed without user interaction or confirmation, after which the attacker achieves code execution in the developer's environment. The scope is significant — these tools are embedded in CI/CD pipelines, developer workstations, and automated build systems across virtually every major software organisation. Practitioners should audit plugin sources and integrity verification mechanisms in their AI tooling, treat coding agent plugin directories as high-value attack surfaces, and monitor for unexpected plugin installations or modifications. The fact that all four leading agents are affected simultaneously suggests a systemic weakness in how the ecosystem handles plugin trust rather than an isolated vendor flaw.

Android Malware Economy Expands to Vehicle Infotainment Systems

The first malware explicitly designed for Android-based automotive infotainment systems has been documented, marking a concrete expansion of the mobile threat landscape into connected vehicles. Android Auto and embedded Android variants power infotainment in a growing share of modern vehicles, and attackers appear to be applying the same distribution and monetisation playbook proven in the mobile ecosystem — malicious apps, credential harvesting, and potentially lateral movement toward vehicle control systems or paired mobile devices. For enterprise security teams, the risk isn't hypothetical: executive vehicles, fleet cars, and employee-owned connected vehicles all represent endpoints that sync with corporate mobile devices and, in some cases, enterprise networks. The attack surface extends to any organisation with a vehicle fleet, particularly those using telematics platforms or allowing mobile device pairing. Security leaders should begin assessing connected vehicle exposure in the same framework applied to IoT and unmanaged endpoints.

Cyberattack Disrupts International Meteor Tracking Network

A cyberattack has taken offline a non-profit organisation dedicated to tracking meteors and near-Earth objects, disrupting observational data collection and public reporting. While the specific attack vector hasn't been confirmed publicly, the incident underscores that threat actors — whether financially motivated ransomware groups or opportunistic attackers — show no discrimination based on mission or public benefit. For practitioners, the more instructive angle is that scientific and research organisations, typically running underfunded IT infrastructure with minimal security tooling, increasingly find themselves in the blast radius of attacks that may target adjacent organisations or simply opportunistically exploit exposed systems. Research networks, academic institutions, and non-profits handling observational or public-interest data deserve the same baseline hardening as commercial targets — and rarely receive it.

Schrödinger's Feed

Q-SAFE Solutions GmbH has launched a carrier-grade quantum-safe network platform across EU-27 member states, combining Quantum Key Distribution and Post-Quantum Cryptography into a centrally managed hybrid key system that operates over existing fibre-optic infrastructure — no rip-and-replace required. Simultaneously, ICTK and Jiran Security's Q-BRIDGE initiative is offering enterprises, governments, and financial institutions an end-to-end PQC migration service covering diagnostic auditing through to deployment. What's notable here isn't any single product, but the pace of commercial PQC infrastructure hitting the market: the standards are ratified, the tooling is maturing, and vendors are now competing on migration ease rather than algorithm selection. Practitioners managing long-lived PKI, encrypted archives, or regulated data should treat "harvest now, decrypt later" as an active threat model and start PQC readiness assessments before procurement cycles force the conversation anyway.

/dev/random

South Korea has dramatically raised the ceiling on data breach fines to 10% of annual global revenue — a number that puts it in the same conversation as GDPR's top tier but applied specifically to breach incidents rather than general non-compliance. The practical implication is that a mid-sized Korean conglomerate suffering a breach could face penalties running into the hundreds of millions before any class action enters the picture. The move reflects a broader regulatory trend of tying penalties to revenue rather than fixed caps, which historically proved easy for large organisations to absorb as a cost of doing business. Somewhere, a CISO is updating their board presentation with a very large number in red.