Cisco
A CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, found by Cisco's own support team during a TAC case and now under active exploitation. No workaround exists. Here's the mechanism, who's affected, and what to check in your logs.
Zero-Day
Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after a weekend of quiet shutdown warnings and NCSC pre-notifications. Here's the mechanism, who's affected, and the September 30 deadline.
CISA KEV
CISA added nine actively exploited CVEs to KEV last week, from F5 and Arista to WordPress, SharePoint, MikroTik, and a fresh pair of Citrix NetScaler zero-days. Here's what happened, and what's still due.
CISA KEV
WatchTowr's honeypot network caught active exploitation of a WSO2 JWT algorithm bypass, with forged tokens granting full access to every backend API a compromised gateway proxies. CISA added it to KEV; federal agencies must patch by September 27.
RCE
Vercel has disclosed a critical remote code execution flaw in the Node.js implementation of ImageResponse in Next.js, tracked as CVE-2026-94545. It carries a CVSS of 9.5, and it is network-reachable with no authentication and no user interaction. But whether it affects you comes down to a detail
Active Exploitation
CISA confirmed active exploitation of a Zyxel GS1900 switch vulnerability patched back in June, after GreyNoise found nearly 1,000 compromised devices across 48 countries. Here is the mechanism, who is affected, and what is due by September 24.
Weekly Digest
CISA added seven actively exploited vulnerabilities to its KEV catalog in one week, spanning Cisco, Acronis, Google Pixel, and the Linux kernel. Here is what happened, in order, and what is due today.
CVE
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE authentication entirely, CVSS 10.0, already under active exploitation. It's the second Cisco zero-day found via live incident response this week.
CVE
CVE-2026-65414 is a CVSS 9.8 out-of-bounds write in Apple's Bluetooth stack, patched across iOS, macOS, watchOS, tvOS, and visionOS. No known exploitation yet, but the CVSS "Network" label is easy to misread.
CVE
CVE-2026-76461 lets an unauthenticated attacker reach root on Cisco Secure Email Gateway with nothing but a crafted email. Cisco found it while investigating an active intrusion, not before one.
CVE
CVE-2026-85706, a path traversal flaw in GitLab's commits API, hit CVSS 10.0 and CISA's KEV catalog within a day. But there's one exposure condition that determines whether your instance is actually at risk.
Security Alert
MikroTik RouterOS is being actively exploited, and CVE-2026-86060 is in the CISA KEV catalog. Here is the interesting part for anyone who prioritizes by severity score: at the time of writing, this CVE has no CVSS score. NVD has not analyzed it yet. If your triage process starts with "