Security incidents in September 2026

Cisco SD-WAN Manager has a critical login bypass (CVE-2026-76504) that attackers have been using since September. Fixes exist for every supported release. Businesses should upgrade now, keep the console off the internet and have Cisco check for compromise.

A CoreGraphics flaw could let a malicious file run code on affected iPhones, iPads and Macs. Targeted exploitation was reported. Fixes now include older devices: install the latest Apple software update offered for your device.

Two critical Citrix NetScaler ADC/Gateway flaws were exploited as zero-days from early or mid September and fixed on 27 Sept. One needs no login or special setup. Organisations running their own appliances should update at once, check for compromise, and use the newer 14.1-73.

Attackers are exploiting CVE-2026-65660 in on-premises SharePoint Server 2016, 2019 and Subscription Edition to run code. Microsoft fixed it in August. IT teams should install the August updates and check the June ones. SharePoint Online is not listed as affected.

WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway have a CVSS 10 flaw (CVE-2026-5430) that lets attackers forge admin tokens. It is being used in attacks. Business IT teams should apply WSO2's May 2026 fixes and rotate credentials. Nothing for home users.

A critical Adobe Commerce and Magento flaw (CVE-2026-71362) lets attackers take over customer accounts with no login. Attacks began right after the August patch and CISA listed it on 24 Sep. Shop owners should apply Adobe's APSB26-92 patch now.

F5 BIG-IP APM flaw CVE-2026-94127 (CVSS 9.8) lets attackers run code without logging in and is being exploited. Affects systems with an APM access policy and OAuth profile. IT teams: apply F5's hotfix for your branch, or ask F5 Support for the iRule workaround.

Arista's on-prem VeloCloud Orchestrator has a maximum-severity input flaw (CVE-2026-93952) under attack. Fixed only in 5.2.3.16 and 6.4.2.8; 6.1 and 7.0 have no fix listed. Organisations should patch, restrict web access to admin networks and check logs.

Check Point says two critical, no-login flaws are being used in attacks: CVE-2026-85102 (VPN on gateways and Spark firewalls) and CVE-2026-93616 (management servers). Fixes exist for supported versions. Install them now and review VPN logs.

WordPress flaw CVE-2026-87902 lets anyone without a login make a site load a chosen PHP file, and can lead to code execution. CISA lists it as exploited. Fixed in 7.1.2 and backports to 4.7. Update WordPress, or ask your web host or developer to.

Attackers have used CVE-2026-7273 to steal data from Zyxel GS1900 network switches. Zyxel describes a local-network attack without a login. Fixes cover all ten listed models: ask your network installer to update the exact model's firmware.

CISA says attackers are using three Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266). Kernel fixes exist, but coverage varies by distribution and device. Update your Linux system, router or appliance firmware; ask the vendor if unsure.

Cisco ISE and ISE-PIC have a CVSS 10 login bypass (CVE-2026-76460) that attackers are already using. Fixed in 3.1 Patch 12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4. Mainly a business system: patch, and re-image any node showing signs of compromise.

Acronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin have a flaw (CVE-2026-87886) that lets a logged-in user gain full control of the server. Limited attacks seen on cPanel. Hosting admins: update the plugin. Home users: nothing to do.

Google fixed an exploited Pixel modem flaw that needs no user interaction or prior privileges. Install the latest Pixel update and check for security patch level 2026-09-05 or later. Fix coverage for other devices using affected Samsung chips is unconfirmed.

Cisco Secure Email Gateway flaw CVE-2026-76461 (CVSS 9.8) lets an unauthenticated attacker gain root with a crafted email, and is being used in attacks. Fixed in 15.5.5-014, 16.0.4-302 and 16.5.0-780. No workaround. Businesses running the appliance should update now.

Attackers chained two JFrog Artifactory flaws (CVE-2026-42016, CVE-2026-42018) to become admin on self-hosted servers and install backdoors. Fixes exist. Upgrade, but assume compromise if exposed: plugins and stolen keys survive patching. JFrog Cloud needs no action.

Attackers have exploited a GitLab flaw that lets them read server files without logging in. Organisations hosting GitLab themselves should update and investigate possible exposure. GitLab.com and GitLab Dedicated are patched.

Attackers used CVE-2026-20079 to take over Cisco firewall-management servers without logging in. Ask your business or family office’s IT provider to update FMC and check for intruders. Cisco has already patched SCC Firewall Management.

CISA says attackers are using CVE-2026-19490, a login bypass in Citrix NetScaler Gateway and AAA servers. Citrix fixed it on 19 Aug in 14.1-73.32 and 13.1-63.21 (and FIPS builds).

Fortinet FortiOS and FortiSwitchManager flaw CVE-2025-25249 is now used in attacks (CISA, 9 Sep 2026). Fixes exist for FortiOS 7.0 to 7.6 and FortiSwitchManager; FortiOS 6.4 has none. Update, or block UDP 5246-5249 from untrusted sources.

A critical ScreenConnect flaw (CVE-2026-84869, CVSS 9.9) lets attackers push and run files in remote sessions without approval. CISA says it is being exploited. Self-hosted users should update to 26.6.5 and reinstall host clients. Cloud instances were already updated.

Attackers can run code without logging into vulnerable N-able N-central servers used by IT providers. Install 2026.3 Hotfix 4 (2026.3.1.14) and investigate suspicious accounts and activity. N-able's hosted instances were already patched.

Attackers used StyleSmuggler to compromise Adobe Commerce and Magento shops without logging in. Apply Adobe's VULN-39341 hotfix plus October security fixes, check for backdoors and rotate exposed credentials. Monthly patches alone are insufficient.

Attackers are exploiting a login bypass in Kestra OSS workflow servers to run code without credentials. Administrators should install 1.0.45 or 1.3.21 for their branch, restrict network access and check for unauthorised workflows.

LiteLLM's MCP endpoint accepted any made-up Bearer token as a valid login (CVE-2026-59822). CISA lists it as exploited. Anyone running LiteLLM before 1.84.0 should upgrade, or block /mcp/ at the proxy until they can.

JFrog Artifactory flaw CVE-2026-82329 (CVSS 9.8) lets an unauthenticated attacker gain admin access on default self-hosted setups, and is being exploited. Update to your branch's fixed version, e.g. 7.161.20, and review admin tokens and accounts.

Attackers are exploiting CVE-2026-9586, a login-free SQL injection in Sangoma Switchvox business phone systems that can give them remote code execution. Sangoma fixed it in 8.4.0.2 on 14 July. Update now, and check for signs of compromise.

Starlette, the framework under FastAPI and many AI tools, has a Host-header flaw (CVE-2026-48710, "BadHost") that can bypass path-based login checks. CISA says it is exploited. Fixed in Starlette 1.0.1: developers should update and rebuild their apps.

Attackers took over MikroTik routers with SSH exposed to the internet. Install the latest supported RouterOS update and check for unauthorised changes. September's first RouterOS 7 updates left a separate certificate flaw incompletely fixed.

SonicWall SMA1000 remote-access appliances (6210, 7210, 8200v) have two flaws used in attacks: a login-free request-forgery bug (CVSS 10) and an admin-level command flaw. Hotfixes exist. Businesses should apply them and ask SonicWall to check for compromise.

Japan's Keio confirmed ransomware on its group servers on 26 Sept 2026 and cut its network. Keio Plaza Hotel warned of slow enquiry replies. No data leak is confirmed; trains are unaffected. Guests with bookings should confirm them with the hotel by phone.

Times Car, Japan's car-sharing service, says data from about 6.6 million current and former accounts was stolen, including driver's licence details and ID images. Passwords were stored unreadably and cards were not exposed. Be wary of messages claiming to be Times Car.

Crypto casino Duelbits lost about US$7M from hot wallets on 24 Sep. It reopened on 27 Sep and says user funds are safe. No cause or recovery has been published. Users: keep only what you're willing to risk on the platform.

A flaw in a Pentagon personnel file-sharing system exposed unencrypted Social Security numbers of about 3.05 million people, living and deceased, from Oct 2025 to July 2026. Fixed. Use the free IDX credit monitoring offered in your letter and consider a credit freeze.

Attackers stole US$387.5 million from Bitget’s exchange wallets, later reported as about US$388 million. Withdrawals fully resumed on 2 October. Bitget says customer balances were unaffected. Use official channels and beware recovery scams.

Ransomware disrupted Nipigon hospital’s outpatient tests and scans. A later hospital notice confirms stolen patient information. Check whether you fall within its affected groups and watch for impersonation scams.

Revolut disclosed customer records after fraudulent requests from a genuine government email domain. About 680 people were reportedly affected; Revolut has not confirmed that count. Check with in-app support and beware of personalised scams.

Gyazo’s breach affected account records and image metadata, including location data and extracted text. Some images were accessed. Change your Gyazo password and similar passwords elsewhere; review older images before restoring sharing.

A Vietnam-linked database exposed 220.8 million passenger and crew travel records from 2017–2026. Access closed in June; malicious copying is unconfirmed. Travellers should verify unexpected requests using their trip or passport details.

An Elements flaw let an attacker drain roughly US$320 million from Liquid's bitcoin reserves. Full L-BTC backing is restored, but direct Federation withdrawals remain restricted. SideSwap conversions are open; no wallet or key change is required.

DriveWealth’s September breach exposed data of some Stake, Hatch and Revolut investment customers, including former customers. Some US customers’ Social Security numbers were involved. Check your notice and verify unexpected investment calls directly.

Pegasus and NoviSpy-related spyware compromised Serbian activists’ phones. Later findings extended to a university rector. Update devices, enable iPhone Lockdown Mode if at risk, and get expert help immediately after a spyware alert.

IDScan confirmed a VeriScan cloud breach linked to a service advertising 153 million licence records, not a confirmed victim count. People whose IDs were scanned by affected businesses should check notices and use the free identity protection offered.

Poisoned Brevo scripts exposed website visitors to fake verification prompts and attempted WordPress backdoor installation. Brevo stopped the injection; anyone who ran a prompted command, and affected site owners, still need to check for compromise.

Attackers used stolen credentials for the Ribon apps on BigCommerce stores, 13 to 17 September, to take shoppers' names, emails, phones and addresses. Passwords and cards weren't included. Expect targeted phishing and texts, and don't act on unexpected messages.

Researchers found four booby-trapped browser extensions (J7Tracker, VREO, Orbit Tracker) stealing login sessions and wallet data from Axiom Trade and Padre users. Chrome listings are gone; Orbit Tracker was live on Firefox. Remove them and log out of those sites.

Fake Google Play pages offered TVTap downloads that installed RemControl on Android phones, targeting bank customers in Europe, Canada and Gulf states. Avoid these downloads; if installed, stop banking on the phone and contact your bank from another device.

CERT Polska linked 852 Facebook ads to 17 Google Play apps that secretly ran premium SMS and carrier-billing fraud on Polish phones. Google removed the apps and Meta the reported ads, but installed copies and servers stayed active. Remove any such apps and check phone bills.

RatHat spreads through fake Android downloads promoted by texts and adverts, stealing bank logins, verification codes and screen locks. Keep Play Protect on; if infection is confirmed, seek help to factory-reset the device and secure exposed accounts.

Attackers used Trezor’s email provider to send wallet-backup phishing to about 347,000 subscribers. Delete the message. If you disclosed your backup, immediately move your funds to a new wallet.