Exploited CVEs Last Week: September 14-21, 2026

This week, CISA's Known Exploited Vulnerabilities catalog got busy. Between September 14 and September 18, the agency added seven vulnerabilities spanning email security, network access control, backup software, mobile devices, and the Linux kernel itself. Three arrived in one alert on September 16 alone. Three more landed on September 18 with a federal remediation deadline of September 21, which is today.

None of these seven are theoretical. Every one is confirmed under active exploitation, which is the only reason a CVE lands in KEV in the first place. Treating them as one story instead of seven separate ones is useful precisely because the pattern is the point: attackers are working every layer of the stack at once, from the kernel that runs production servers to the phone in an employee's pocket.

Here is what CISA added, in the order it happened, and what each one actually requires from you.

September 14: Cisco Secure Email Gateway (CVE-2026-76461)

The week opened with a pre-authentication SQL injection in Cisco Secure Email Gateway's message-parsing logic. An unauthenticated attacker sends a single crafted email through an affected gateway. The malformed content reaches a database query unsanitized, and from there an attacker can run arbitrary SQL and ultimately execute commands with root privileges on the underlying operating system. No login, no attachment click, no user interaction of any kind. The email itself is the exploit.

CVSS 9.8. Cisco confirmed active exploitation before the fix shipped, so this qualifies as a true zero-day rather than a patched bug caught being reused. CISA added it to KEV on September 14 with a three-day deadline, meaning federal remediation was already due on September 17. If your organization runs Secure Email Gateway and has not patched, this deadline has been behind you for four days.

Fixed AsyncOS versions: 15.5 and earlier move to 15.5.5-014, 16.0 moves to 16.0.4-3021, and 16.5 moves to 16.5.0-780.

September 16: Identity, Backup, and Mobile, All in One Alert

Two days later CISA added three more vulnerabilities in a single day, and the spread is what makes this wave notable. It is not one product family under pressure. It is three unrelated categories of infrastructure hit in the same 24 hours.

Cisco ISE authentication bypass (CVE-2026-76460). The most severe of the seven, at CVSS 10.0. Cisco Identity Services Engine versions 3.0 through 3.5 expose a management API endpoint with insufficient authentication controls. An unauthenticated attacker sends a crafted request to that endpoint and gets root-level command execution, with the ability to tamper with or wipe system logs afterward, erasing evidence of how they got in. ISE sits at the center of network access control for most enterprises that run it, deciding who and what gets onto the network, so a root-level bypass here is close to a worst case. KEV addition and three-day deadline both landed September 16, which put remediation due September 19. That date has already passed.

Acronis Backup plugin, insecure file permissions (CVE-2026-87886). A local privilege escalation, CVSS 7.8, in the Acronis Backup plugin for cPanel and WHM (builds before 1.9.3.1021) and the Acronis Backup extension for Plesk (builds before 1.8.11.638). Insecure file permissions let a low-privileged local user climb to a higher permission level on the Linux host. Acronis says it detected exploitation in limited, targeted attacks, though the company is candid that this assessment currently rests on a single customer report rather than broad telemetry. Fixed in cPanel and WHM build 1.9.3 HF3 and Plesk build 1.8.11.

Google Pixel modem elevation of privilege (CVE-2026-58704). Reported severity High, affecting the cellular modem component on Pixel devices, with Google's own bulletin stating there are indications of limited, targeted exploitation. Coverage of the incident describes zero-click delivery, meaning no interaction from the device owner was needed. Google shipped the fix in the September 2026 Pixel security patch level; CISA's three-day clock also expired September 19.

September 18: Three Linux Kernel Bugs, Due Today

The final wave is the one with a live clock. CISA added three Linux kernel vulnerabilities to KEV on September 18, and because these affect federal systems broadly rather than a single vendor's appliance, the three-day remediation window closes today, September 21.

Netfilter ebtables SNAT ARP rewrite (CVE-2026-53266). An out-of-bounds write, CWE-787, in the bridge netfilter ebtables SNAT target. On a system configured with specific bridge netfilter rules, a local attacker can corrupt underlying shared memory pages during an ARP hardware-address rewrite. NVD scores it CVSS 8.8; Red Hat's own contextual assessment for its affected products is somewhat lower, an illustration of how the same flaw can carry different real-world risk depending on how a distribution ships bridge networking. The affected range spans a long stretch of kernel branches, so this is not confined to recent installs.

AF_ALG concurrent-write race condition (CVE-2025-39964). CVSS 7.8, CWE-366. The kernel's cryptographic user API allows multiple writers on the same AF_ALG socket without exclusive ownership, so concurrent writes interleave and corrupt internal socket state. The consequence is a crash or, more concerning for anything relying on that socket for cryptographic operations, unpredictable corrupted output. The fix adds exclusive write ownership so only one writer can be in sendmsg() at a time.

Kernel TLS receive-path record-type confusion (CVE-2025-39682). A logic bug in the kTLS receive path mishandles zero-length records pulled from the rx_list, letting a mixed record-type sequence slip past the type constraint recvmsg() is supposed to enforce. NVD lists this at CVSS 9.8; Red Hat's contextual score sits closer to 7.0 to 7.1, reflecting a local rather than pure-network attack complexity in its own products. Either way, this only matters on systems actually using kernel TLS receive offload, not every machine that happens to run TLS. It has been sitting in the kernel since September 2025, over a year, before CISA confirmed exploitation and forced the issue. Debian 11 appears explicitly in the affected software list.

All three share the same September 21 deadline. If your fleet includes federal systems, or you simply follow CISA's cadence because it is a reasonable one to follow, today is the day this gets done.

Reading These on VulnTracker

Each of these seven has its own page on VulnTracker, and the CISA KEV banner is the fastest way to confirm status without digging through separate advisories: Added-to-KEV date, Remediation-Due date, and whether that date has passed, all in one place. The SSVC markers matter more than usual this week, since automatable exploitation (Cisco ISE, Cisco Secure Email Gateway) changes how fast you need to move compared to a bug that requires local access and specific configuration (the netfilter ARP rewrite). Track each CVE individually if your stack only touches some of them, or use the Newsroom tab on any one of them to see how the exploitation reporting evolved over the week, since several of these stories developed in real time as researchers and vendors published more detail after the initial disclosure.

What to Do Right Now

With seven CVEs and three different deadlines, prioritize by what is overdue versus what is due today, not by CVSS score alone:

1. If you run Cisco Secure Email Gateway, Cisco ISE, Acronis's cPanel or Plesk backup plugins, or manage Pixel devices, and have not patched, treat that as already late. These deadlines passed on September 17 and September 19.
2. If you run Linux systems anywhere in your environment, today is the actual deadline for the netfilter, AF_ALG, and kTLS kernel issues. Check your kernel version against the patched branches before assuming you are covered, since the affected ranges span years of releases.
3. Confirm whether kernel TLS receive offload is actually enabled before treating CVE-2025-39682 as universal. It is not relevant to every Linux host, only ones using kTLS.
4. For Cisco ISE specifically, check system logs for signs of tampering in addition to patching. The vulnerability's design allows an attacker to erase evidence of exploitation, so a clean-looking log is not proof of a clean system.
5. Segment or restrict network access to affected services as a stopgap wherever patching cannot happen today, particularly for the two Cisco flaws that require no authentication at all.

The Takeaway

Seven CVEs in one week, three separate KEV additions, and deadlines that range from four days overdue to due this afternoon is not an unusual week anymore. It is close to the current baseline. The organizations that handle weeks like this well are not the ones scrambling to read seven advisories from seven vendors after the fact. They are the ones with one place that already tracks KEV status, due dates, and exploitation evidence across everything they run.

Add these seven CVEs to your watchlist on VulnTracker and get notified the moment any of them changes status, whether that is a new exploitation report, a KEV update, or a fresh patch.

References

Cisco Secure Email Gateway advisory and NVD (CVE-2026-76461); Cisco ISE advisory and NVD (CVE-2026-76460); Acronis Advisory Database SEC-10986 and NVD (CVE-2026-87886); Google Pixel Security Bulletin September 2026 (CVE-2026-58704); Red Hat CVE database and NVD (CVE-2026-53266); Red Hat CVE database and NVD (CVE-2025-39964); Red Hat CVE database and NVD (CVE-2025-39682); CISA Known Exploited Vulnerabilities Catalog additions, September 14, 16, and 18, 2026; The Hacker News, "CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild."