CISA KEV
CISA added nine actively exploited CVEs to KEV last week, from F5 and Arista to WordPress, SharePoint, MikroTik, and a fresh pair of Citrix NetScaler zero-days. Here's what happened, and what's still due.
CISA KEV
WatchTowr's honeypot network caught active exploitation of a WSO2 JWT algorithm bypass, with forged tokens granting full access to every backend API a compromised gateway proxies. CISA added it to KEV; federal agencies must patch by September 27.
Active Exploitation
CISA confirmed active exploitation of a Zyxel GS1900 switch vulnerability patched back in June, after GreyNoise found nearly 1,000 compromised devices across 48 countries. Here is the mechanism, who is affected, and what is due by September 24.
Weekly Digest
CISA added seven actively exploited vulnerabilities to its KEV catalog in one week, spanning Cisco, Acronis, Google Pixel, and the Linux kernel. Here is what happened, in order, and what is due today.
CVE
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE authentication entirely, CVSS 10.0, already under active exploitation. It's the second Cisco zero-day found via live incident response this week.
CVE
CVE-2026-65414 is a CVSS 9.8 out-of-bounds write in Apple's Bluetooth stack, patched across iOS, macOS, watchOS, tvOS, and visionOS. No known exploitation yet, but the CVSS "Network" label is easy to misread.
CVE
CVE-2026-76461 lets an unauthenticated attacker reach root on Cisco Secure Email Gateway with nothing but a crafted email. Cisco found it while investigating an active intrusion, not before one.
CVE
CVE-2026-85706, a path traversal flaw in GitLab's commits API, hit CVSS 10.0 and CISA's KEV catalog within a day. But there's one exposure condition that determines whether your instance is actually at risk.