Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

This Week's KEV Additions

Note: EPSS scores are as published by FIRST.org at time of writing and are not updated after publication; scores change daily.

Analysis

CVE-2026-76460 — Cisco / Identity Services Engine (ISE) & ISE-PIC

• What it is: Insufficient authentication control on an ISE API endpoint (CWE-648, incorrect use of privileged APIs) lets an unauthenticated remote attacker send a crafted request, bypass the web-based management interface, and gain unauthorized access to the device, potentially reaching root-level command execution.

• Affected versions: Cisco ISE and ISE-PIC; first fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. ISE 3.0 has reached End of Software Maintenance and must migrate to a supported release.

• Exploitation status: Cisco PSIRT confirmed active exploitation; the flaw was identified while resolving a Cisco TAC support case. No public threat-actor attribution has been disclosed.

• Patch available: Yes — apply the fixed patch release for your ISE version. No workaround fully addresses the vulnerability; infrastructure ACLs (iACLs) restricting management-plane traffic are only a temporary mitigation.

• CISA due date: 2026-09-19

• Operational risk: ISE is the central policy decision point for network access control; an unauthenticated attacker who reaches root on this platform can alter who and what is allowed onto every network segment ISE governs, and may conceal evidence of the intrusion given root-level access to the device.

CVE-2026-76461 — Cisco / AsyncOS Software for Secure Email Gateway

• What it is: Insufficient validation in AsyncOS's email-parsing logic (CWE-89, SQL injection) lets an unauthenticated remote attacker send a crafted email containing malicious SQL statements, resulting in arbitrary SQL execution and ultimately root-level command execution on the underlying operating system.

• Affected versions: All physical and virtual Cisco Secure Email Gateway appliances regardless of configuration; first fixed releases are 15.5.5-014, 16.0.4-302, and 16.5.0-780 (Cisco recommends migrating to 16.5.0-780 where supported). Secure Email and Web Manager and Secure Web Appliance are not affected.

• Exploitation status: Cisco PSIRT confirmed active exploitation at time of disclosure.

• Patch available: Yes — no workaround exists; the software update is the primary remediation.

• CISA due date: 2026-09-17

• Operational risk: Because exploitation requires only sending an email to a vulnerable gateway — no authentication, admin access, or user interaction — every internet-facing Secure Email Gateway is exposed simply by performing its normal function, giving an attacker root on core email-security infrastructure.

CVE-2025-39682 — Linux / Kernel (TLS receive path)

• What it is: An improper check for unusual or exceptional conditions in the kernel TLS (kTLS) receive path allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, so subsequent TLS records can be processed under incorrect zero-copy and queuing assumptions.

• Affected versions: Linux kernel builds with kTLS enabled on TCP sockets, prior to the upstream fix in net/tls/tls_sw.c ("tls: fix handling of zero-length records on the rx_list"); exact affected version ranges vary by distribution kernel.

• Exploitation status: CISA cites evidence of active exploitation; a remote peer can reportedly send a three-record sequence (application data, a zero-length non-data record, and more application data) to trigger the flaw. No named threat actor or campaign has been publicly attributed.

• Patch available: Yes — apply the vendor/distribution kernel update containing the upstream fix.

• CISA due date: 2026-09-21

• Operational risk: This is a network-reachable, unauthenticated, no-user-interaction flaw (CVSS 9.8) affecting any Linux system using kernel TLS to receive encrypted traffic, making it relevant to a broad range of internet-facing Linux services rather than a narrow configuration.

CVE-2026-53266 — Linux / Kernel (netfilter bridge ebtables)

• What it is: During the ebtables SNAT target's optional ARP sender hardware-address rewrite, the kernel can call skb_store_bits() without first ensuring the destination range is writable; if that data sits in a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly in the underlying page, corrupting kernel memory (CWE-787, out-of-bounds write).

• Affected versions: No explicit upstream version range is published; any Linux kernel build prior to the fixing commit ("netfilter: bridge: make ebt_snat ARP rewrite writable") that uses bridge ebtables with the SNAT ARP-rewrite option is affected.

• Exploitation status: CISA cites evidence of active exploitation; a public proof-of-concept repository exists. Red Hat notes a local attacker on a system configured with specific bridge netfilter rules could trigger memory corruption, denial of service, or potential privilege escalation.

• Patch available: Yes — apply the vendor/distribution kernel update containing the upstream fix.

• CISA due date: 2026-09-21

• Operational risk: Hosts using bridge ebtables with SNAT ARP rewriting — common in container and virtualization networking — face kernel memory corruption that can lead to denial of service or local privilege escalation, extending risk beyond the host itself to anything sharing that networking layer.

CVE-2026-58704 — Google / Pixel (Cellular Modem)

• What it is: A logic error in the cellular modem's permission checks (improper authorization) may allow an attacker to bypass those checks and escalate privileges, with Google's advisory describing remote (proximal/adjacent) escalation of privilege requiring no additional execution privileges and no user interaction.

• Affected versions: Supported Google Pixel devices (Pixel 6 series through the Pixel 11 family, plus Pixel Tablet and Pixel Fold) with a security patch level prior to 2026-09-05.

• Exploitation status: Google has confirmed indications that the vulnerability "may be under limited, targeted exploitation," without disclosing further detail on the threat actor or victims.

• Patch available: Yes — the September 2026 Pixel security update (patch level 2026-09-05 or later).

• CISA due date: 2026-09-19

• Operational risk: Because exploitation requires no user interaction and only radio-range proximity, this flaw fits the profile typically used in targeted attacks against high-risk individuals (journalists, executives, activists, diplomats); enterprises with BYOD or mobile-first policies should treat unpatched Pixel devices as a credible entry point into corporate data and accounts.

CVE-2025-39964 — Linux / Kernel (AF_ALG crypto interface)

• What it is: A race condition in the kernel's AF_ALG cryptographic user API allows concurrent writes to the same AF_ALG socket, causing request payloads to interleave unpredictably and leaving the per-socket context inconsistent (CWE improper check for exceptional conditions / race condition).

• Affected versions: Linux kernel builds prior to the upstream fix in crypto/af_alg.c ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg"); exact affected version ranges vary by distribution kernel.

• Exploitation status: CISA cites evidence of active exploitation; the fix adds exclusive write ownership so only one writer can use sendmsg() at a time. No campaign or threat-actor details have been publicly disclosed.

• Patch available: Yes — apply the vendor/distribution kernel update containing the upstream fix.

• CISA due date: 2026-09-21

• Operational risk: A local user can use this flaw to crash the system or corrupt cryptographic operation results, causing denial of service or data-integrity issues on any system exposing AF_ALG socket access to less-trusted local users or processes.

CVE-2026-87886 — Acronis / Backup plugin for cPanel & WHM and extension for Plesk

• What it is: Insecure default file permissions (CWE-276) in the Linux-based Acronis backup components can allow a local, low-privileged attacker to access resources or execute actions beyond their intended privilege level, leading to local privilege escalation.

• Affected versions: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 (fixed in 1.9.3 HF3); Backup extension for Plesk (Linux) before build 1.8.11.638; Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

• Exploitation status: Acronis has confirmed exploitation in the wild against the cPanel & WHM plugin specifically; it has not reported corresponding active exploitation against the Plesk extension.

• Patch available: Yes — upgrade to the fixed build for your platform (advisory SEC-10986).

• CISA due date: 2026-09-19

• Operational risk: These plugins connect hosting control panels to Acronis backup infrastructure, so the flaw is particularly significant for hosting providers and MSPs: a low-privileged account on one shared server could escalate privileges and potentially affect backup data or configuration shared across many downstream customers.

Exploitation Context

Cisco accounts for two of this week's seven additions, disclosed within 48 hours of each other: a maximum-severity authentication bypass in Identity Services Engine (CVE-2026-76460) and a SQL-injection-to-root flaw in Secure Email Gateway (CVE-2026-76461), both confirmed exploited by Cisco PSIRT before or at the time of disclosure. Both sit on infrastructure that is inherently internet-reachable by design — ISE as a network access-control decision point, and SEG because processing inbound email is its core function — which removes the usual "is it exposed" question defenders would otherwise need to answer.

CISA also added three Linux kernel vulnerabilities on September 18, 2026 (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964), citing evidence of active exploitation for all three and requiring forensic triage rather than treating patching alone as sufficient. None of the three has named campaign or threat-actor attribution attached, but their combined addition on a single day, spanning both a network-reachable kTLS flaw and two local kernel-memory issues, points to broader interest in Linux kernel primitives as post-compromise or defense-evasion tooling. Separately, Google confirmed limited, targeted exploitation of a zero-click Pixel modem flaw (CVE-2026-58704), consistent with the profile of surveillance-style attacks against specific individuals rather than opportunistic mass exploitation.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2026-76460 (Cisco ISE):

  • Log Sources: ISE syslog forwarded to SIEM; access.log; external network/firewall telemetry for the ISE management plane.

  • Behavioral Indicators: direct requests to privileged REST/ERS API endpoints from sources outside expected admin networks; unexpected administrative sessions or configuration changes with no corresponding successful web-portal login.

  • Monitoring Gap / Detection Artifacts: exploitation bypasses the web management interface entirely, so traditional failed-login alerting will not catch it; visibility must come from API-plane traffic and external telemetry rather than node-local logs alone, since an attacker with root access may remove or conceal local evidence.

• CVE-2026-76461 (Cisco Secure Email Gateway):

  • Log Sources: IronPort Text Mail Logs (mail_logs), reviewed across every device if the gateway is part of a cluster.

  • Behavioral Indicators: suspicious SQL statements embedded in processed email content, such as entries matching "COPY...TO PROGRAM".

  • Monitoring Gap / Detection Artifacts: Cisco's advisory provides the mail_logs grep pattern above as the primary confirmation method; no public PoC exploit code is currently available, and Rapid7 InsightVM/Nexpose exposure checks became available in the September 16 content release.

• CVE-2025-39682 (Linux kTLS):

  • Log Sources: kernel/dmesg logs on hosts using kTLS; application-level logs for services that terminate TLS in-kernel.

  • Behavioral Indicators: unusual TLS record sequences (application data, followed by a zero-length non-data record, followed by more application data) directed at kTLS-enabled sockets; unexpected crashes or memory-disclosure symptoms in kTLS-using processes.

  • Monitoring Gap / Detection Artifacts: no public IOC set or named campaign has been disclosed; prioritize patch deployment given confirmed active exploitation and CISA's forensic-triage requirement.

• CVE-2026-53266 (Linux ebtables SNAT):

  • Log Sources: kernel/dmesg logs for memory-corruption or crash signatures; container/virtualization host logs where bridge ebtables SNAT is in use.

  • Behavioral Indicators: unexpected kernel crashes or instability correlated with ARP traffic on bridges configured with ebtables SNAT and ARP rewriting.

  • Monitoring Gap / Detection Artifacts: a public proof-of-concept repository exists (tracked by exploit-intelligence aggregators); no vendor-supplied detection ruleset was identified in reviewed sources, so patching remains the primary control.

• CVE-2026-58704 (Google Pixel modem):

  • Log Sources: device security patch level reporting via MDM/EMM; modem/baseband diagnostic logs where accessible.

  • Behavioral Indicators: unexplained privilege changes or permission-check bypass events tied to the cellular modem subsystem; devices operating below the 2026-09-05 patch level.

  • Monitoring Gap / Detection Artifacts: Google has not disclosed technical exploitation details or IOCs; given the zero-click, no-PoC nature of the reported targeted attacks, MDM patch-level enforcement is the primary practical control.

• CVE-2025-39964 (Linux AF_ALG):

  • Log Sources: kernel/dmesg logs for crash or corruption signatures on hosts exposing AF_ALG socket access.

  • Behavioral Indicators: concurrent writes from a single process/user to the same AF_ALG socket; unexpected cryptographic operation failures or inconsistent results.

  • Monitoring Gap / Detection Artifacts: no public IOC set or named campaign has been disclosed; patch deployment is the primary control, particularly on multi-tenant systems where untrusted local users can reach AF_ALG.

• CVE-2026-87886 (Acronis Backup plugin/extension):

  • Log Sources: cPanel & WHM / Plesk system logs; file-permission audit tooling on hosts running the Acronis plugin or extension.

  • Behavioral Indicators: a low-privileged account accessing files or resources outside its intended permission scope via the Acronis backup components; unexpected privilege changes following plugin activity.

  • Monitoring Gap / Detection Artifacts: Acronis advisory SEC-10986 covers remediation guidance; confirmed exploitation has been reported against the cPanel & WHM plugin specifically, not (so far) the Plesk extension, so prioritize audit of cPanel & WHM deployments.

Hackerstorm Analysis

Cisco's back-to-back zero-days this week — ISE on September 16 and Secure Email Gateway on September 14 — underline a pattern seen repeatedly in KEV data: identity/access-control and email-security infrastructure are attacked precisely because they are designed to be reachable, whether by unauthenticated management requests or by ordinary inbound mail. Neither flaw depends on a misconfiguration; both are exploitable against a default, correctly operating deployment, which removes "is this exposed" as a triage question and leaves only "is this patched."

The three Linux kernel CVEs added on a single day are a reminder that kernel-level bugs, though individually less dramatic than an unauthenticated RCE, are frequently the tooling behind privilege escalation and defense evasion once an attacker already has a foothold; CISA's decision to require forensic triage on all three, rather than treating patch installation as sufficient, reflects that these are being treated as confirmed intrusion vectors, not theoretical risk. Combined with a zero-click, no-PoC Pixel modem flaw under confirmed targeted exploitation, this week's additions span the full range from opportunistic internet-facing infrastructure attacks to narrowly targeted mobile surveillance-style activity, and remediation priority should be set accordingly: unauthenticated, internet-facing flaws first, followed by kernel and local-escalation issues on the same fleet-wide timeline as the next patch cycle.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CVE-2026-76460:

  • Rescana (Threat intel report) — https://www.rescana.com/post/cisco-ise-cve-2026-76460-kev

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html

  • SOCRadar (Threat intel report) — https://socradar.io/blog/cve-2026-76460-cisco-ise-flaw/

  • Dark Reading (Threat intel report) — https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues

• CVE-2026-76461:

  • Rapid7 (Vendor/researcher advisory) — https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild/

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/cisco-secure-email-gateway-flaw.html

  • SOCRadar (Threat intel report) — https://socradar.io/blog/cve-2026-76461-cisco-email-gateway-flaw/

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-76461

• CVE-2025-39682:

  • Cybersecurity News (Threat intel report, CISA-sourced) — https://cybersecuritynews.com/linux-kernel-vulnerabilities-actively-exploited/

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html

  • CVE Security (NVD/CISA KEV aggregator) — https://cve-security.com/cve/cve-2025-39682

  • WindowsForum (Threat intel report) — https://windowsforum.com/news/cve-2025-39682-in-kev-patch-linux-ktls-before-sept-21.445003/

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2025-39682

• CVE-2026-53266:

  • Cybersecurity News (Threat intel report, CISA/Red Hat-sourced) — https://cybersecuritynews.com/linux-kernel-vulnerabilities-actively-exploited/

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-53266

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html

  • Exploit-Intel (CVSS/EPSS/KEV aggregator) — https://exploit-intel.com/vuln/CVE-2026-53266

• CVE-2026-58704:

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/google-patches-pixel-modem-flaw-amid.html

  • 9to5Google (Threat intel report) — https://9to5google.com/2026/09/16/google-pixel-targeted-zero-day-modem-attack/

  • Exploit-Intel (CVSS/EPSS/KEV aggregator, NVD-sourced) — https://exploit-intel.com/vuln/CVE-2026-58704

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2026-58704

• CVE-2025-39964:

  • Cybersecurity News (Threat intel report, CISA-sourced) — https://cybersecuritynews.com/linux-kernel-vulnerabilities-actively-exploited/

  • OpenCVE (NVD-sourced CVE database) — https://app.opencve.io/cve/CVE-2025-39964

  • Red Hat Customer Portal (Vendor advisory) — https://access.redhat.com/security/cve/cve-2025-39964

  • RogoLabs VulnRadar (CVSS/EPSS/KEV aggregator) — https://github.com/RogoLabs/VulnRadar-Demo/issues/247

• CVE-2026-87886:

  • The Hacker News (Threat intel report) — https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html

  • SecurityWeek (Threat intel report) — https://www.securityweek.com/acronis-patches-exploited-vulnerability-in-cpanel-backup-plugin/

  • Cybersecurity News (Threat intel report) — https://cybersecuritynews.com/acronis-plugin-vulnerability-exploited/

  • GBHackers (Threat intel report) — https://gbhackers.com/acronis-backup-plugin-vulnerability/

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.