Skip to content
feed: live
>_0dayNews
Briefing · 2026-09-17

Sep 17: Cisco SEG Deadline Today, GitLab Still Exploited

CISA federal deadline for Cisco CVE-2026-76461 is today. GitLab still exploited past its Sept. 14 deadline. JFrog Artifactory backdoors confirmed. Syncope seven CVEs patched.

tldr.txt
  • CVE-2026-76461 (Cisco Secure Email Gateway, CVSS 9.8): CISA BOD 26-04 federal remediation deadline is today, September 17. Active exploitation confirmed. Patch is out.
  • CVE-2026-85706 (GitLab CE/EE, CVSS 10.0): CISA federal deadline passed September 14. Rapid7's exploitation threat report confirms attacks continued past that deadline. GitLab 19.3.2 is the patched build.
  • JFrog Artifactory: three vulnerabilities confirmed exploited in combination for full admin access and backdoor deployment in build pipelines. JFrog patches out. CISA added CVE-2026-82329 to KEV September 2.
  • Apache Syncope seven critical CVEs (all September 14): search injection across SQL/Neo4j/Elasticsearch, JWT forgery, connector credential exposure, and delegation scope bypass. None confirmed exploited. Patch is available.
  • D-Link DWR-M920 and DWR-M921: three critical command injection CVEs (CVE-2026-90699, -90702, -90703) disclosed September 13-14. No firmware update or advisory from D-Link.

Today is the CISA federal remediation deadline for CVE-2026-76461 in Cisco Secure Email Gateway. Exploitation confirmed since at least September 14. Patch is out.

Cisco CVE-2026-76461: federal deadline today

CVE-2026-76461 (CVSS 9.8, critical). Unauthenticated SQL injection in Cisco AsyncOS for Secure Email Gateway. Successful exploitation gives root OS command execution on the appliance. CISA KEV entry under BOD 26-04, deadline: today.

Cisco confirmed active exploitation. Patch is available. Running unpatched past today’s deadline on a confirmed-exploited perimeter device is a documented organizational decision, not an oversight.

Full coverage.

GitLab CVE-2026-85706: deadline passed September 14, exploitation ongoing

CVE-2026-85706 (CVSS 10.0, critical). Unauthenticated path traversal in GitLab CE and EE. Arbitrary file read, no credentials required. CISA federal deadline: September 14.

Rapid7’s Exploitation Threat Report published September 14 confirms attacks against unpatched instances continued through the week following initial disclosure, past the federal deadline. GitLab 19.3.2 is the patched build.

The attack surface: configuration files, secrets, private keys, deploy tokens, and cached credentials on the server filesystem. An unauthenticated attacker’s only constraint is what the GitLab process can read.

Full coverage.

Also on the board

  • JFrog Artifactory backdoor deployments: Three Artifactory vulnerabilities confirmed exploited in combination. An authentication bypass chained with privilege escalation reaches full administrator access, followed by backdoor deployment in enterprise build pipelines. SecurityWeek confirmed September 14. JFrog patches are out. Whether CVE-2026-82329 (CVSS 9.8, CISA KEV September 2) is part of the current chain is unconfirmed in available reporting. Administrator access to Artifactory is write access to every artifact before it reaches production; every downstream consumer of a compromised repository is in scope.

  • Apache Syncope seven critical CVEs: Seven critical-severity CVEs in Apache Syncope published September 14. Three injection paths: CVE-2026-73579 (CVSS 9.8, FIQL conditions reach SQL/Neo4j/Elasticsearch unsanitized), CVE-2026-86460 (CVSS 9.8, Cypher layer), CVE-2026-82232 (CVSS 9.8, admin-level SQL injection). Two JWT/auth CVEs: CVE-2026-87802 (CVSS 9.1, JWT forgery via missing JWKS URI), CVE-2026-87785 (CVSS 9.1, JWKS disclosure enabling token forgery). Authorization: CVE-2026-73668 (CVSS 9.8, Connector credentials including LDAP bind passwords readable via REST by any Realm admin), CVE-2026-73470 (CVSS 9.8, delegation scope bypass). None confirmed exploited. Patch is available.

  • D-Link DWR command injections, no patch: Researcher H3rmesk1t disclosed three OS command injection CVEs in D-Link DWR-M920 and DWR-M921 mobile routers, September 13-14. CVE-2026-90699 (CVSS 9.9, DWR-M920 1.1.7), CVE-2026-90702 (CVSS 9.1, DWR-M921 1.1.52), CVE-2026-90703 (CVSS 9.1, DWR-M921 1.1.52). Root cause: BOA web server passes form parameters to system() without sanitization. D-Link has not released a firmware update or advisory. The management interface is the attack surface for all three CVEs.

Sources