Skip to content

KEV wave 2026-09-09→16: edge VPN/firewall, mail gateway, NAC management plane, router, and package-infrastructure exploitation

Source: CISA KEV catalog additions 2026-09-09 through 2026-09-16 (catalog 2026.09.16, 1713 entries, including the 20:05Z Acronis addition), cross-checked against GitHub advisory mirrors.

Eleven new KEV entries in eight days concentrate on the perimeter/authentication tier and package infrastructure (the catalog's Sept 14–16 additions are included below, now twelve with the Acronis hosting-plugin entry). For authorized operators this is a sweep-order signal: these are the internet-facing assets customers will be asked about, and several expose durable validation-boundary lessons rather than one-off CVEs.

KEV additions and operator angle

Added CVE Product Class Due Operator angle
09-09 CVE-2026-19490 Citrix NetScaler ADC / Gateway (14.1 ≤ 73.32, 13.1 ≤ 63.21) Authentication bypass via alternate path or channel 09-12 Alternate-path/channel bypass means the named vServer route may be hardened while sibling route families (ICA/VPN/API/management host) are not — enumerate every listener and hosted route family on the appliance, positive/negative controls per family
09-09 CVE-2025-25249 Fortinet FortiOS 6.4–7.6, FortiSASE, FortiSwitchManager Heap overflow via crafted packets 09-12 Old-CVE-in-KEV = still-being-exploited; crafted-packet class on SSL VPN perimeter; treat FortiOS builds as first-priority in any network pentest scope check
09-09 CVE-2026-20079 Cisco Secure FMC / Security Cloud Control Unauth → script execution → root via boot-time process 09-12 Management-plane web UI root RCE: FMC/SCC reachability checks are a standard engagement early-win check; do not probe production — confirm with ownership + version fingerprint
09-09 CVE-2026-87491 Google Chromium V8 (< 153.0.8010.36) OOB write 09-23 Browser memory-safety — tracked for phishing/browser-pivot planning, no public exploit path; not an operator page
09-10 CVE-2026-86060 MikroTik RouterOS SSH login username argument-handling → policy-mask change → privesc 09-13 Username-syntax parsing before authentication: usernames beginning with a prohibited character alter the trusted RouterOS policy mask — argument-injection grammar in an identity field, reachable pre-auth; low-privilege-router foothold → full-admin escalation path for network pentests
09-10 CVE-2026-67277 MikroTik RouterOS "related" btest accepted pre-authentication; uninitialized kernel buffer tail + size underflow 09-13 Protocol state-machine gap: related-channel accepted before primary auth completes; random-data=false leaks kernel memory in UDP test traffic — unauthenticated memory-disclosure grammar in a router's test tooling
09-11 CVE-2026-84869 ConnectWise ScreenConnect client File transfer + execution through active remote session without Host confirmation 09-14 Client-side, not server: the session-host confirmation gate is the control; relevant to red-team C2/session-hijack planning and to any remote-support trust-boundary audit
09-11 CVE-2026-42016 JFrog Artifactory self-hosted < 7.133.11 Token signature/issuer validated but scope not → privilege escalation 09-25 The reusable axis: verify not just is the token valid but does the presented scope survive to the action — mint-scope vs effective-scope decision tables on any token-based registry/API
09-11 CVE-2026-42018 JFrog Artifactory Internal anonymous-user token returned to unauthenticated caller when anonymous access is disabled 09-25 "Feature off" ≠ "credential path closed": the disable flag gated authorization, not token issuance — enumerate credential-issuance routes independently of feature flags
09-11 CVE-2026-85706 GitLab CE/EE 18.7–<19.1.8, 19.2–<19.2.6, 19.3–<19.3.2 Unauth arbitrary file read via repository commits API path confinement gap 09-14 Unauthenticated arbitrary file read on the most-bountied self-hosted platform family; commits-API path normalization vs repo-root confinement — prove with synthetic repo + canary file only, never read real config/keys
09-14 CVE-2026-76461 Cisco Secure Email Gateway (AsyncOS) Email-parsing SQLi → root command execution via crafted email 09-17 Parser-to-SQL-injection at the mail gateway crossing into OS command execution: the inbound-email parsing path is an unauthenticated remote attack input that most perimeters never pen-test; frame validation around lab gateways ingesting synthetic messages only
09-16 CVE-2026-76460 Cisco ISE / ISE-PIC 3.1–3.5 (first fixed: 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4) Unauthenticated API auth bypass — crafted request to an API endpoint skips the web-management-interface authentication control (CVSS 10.0, CWE-648, no workarounds) 09-19 Network-access-control brain goes full-scope unauthenticated via one API route: the reusable axis is that the API layer in front of a management UI is a separate authentication surface. Cisco's own IoC guidance points at the ise-kong API-gateway access log, i.e. the bypass lives in the gateway/router path, not the UI app. On authorized ISE assessments enumerate API route families independently of UI login (positive/negative controls per family), fingerprint patch level, and never attempt the crafted request outside a lab
09-16 CVE-2026-58704 Google Pixel (cellular modem) Improper authorization in modem firmware — permission-check bypass → privilege escalation 09-19 Modem-side logic error, no replayable operator workflow from public sources; tracked for mobile-engagement awareness only
09-16 CVE-2026-87886 Acronis Backup plugin for cPanel & WHM / extension for Plesk (SEC-10986, CWE-276) Incorrect default permissions → privilege escalation 09-19 Third KEV hit on the hosting-control-plugin privilege tier (after the two LiteSpeed cPanel plugin entries on the June 20 boundary page): backup software shipped as cPanel/Plesk extensions runs with host-level privileges and ships world/group-writable or wrongly-owned paths. Shared-hosting recon checklist: inventory installed WHM/cPanel/Plesk extensions (backup, cache, security suites) as root-adjacent code with default-permission audit, not as "customer UI". Tracked as hygiene — no public exploit detail beyond the advisory

October 7 follow-up: WatchGuard Fireware OS BOVPN-over-TLS client config injection → root on the connecting Firebox (CVE-2026-86131 / GHSA-hrq5-fh6w-qjmh, 9.8)

Fireware OS's BOVPN Over TLS client configuration handling code-injects: an attacker who controls the remote VPN server executes arbitrary commands as root on the connecting Firebox. The attacker moves from "VPN peer" to full appliance root by feeding config material to the client side of the tunnel.

  • This is the mirror image of this page's perimeter-VPN focus and a durable new axis: the VPN client on your target network is the target, and the "untrusted internet peer" is the attack position. Config negotiation data crossing a TLS tunnel into shell/command construction on the appliance = root RCE regardless of tunnel crypto. Red-team relevance: a branch/teleworker Firebox configured to dial a BOVPN-over-TLS server an operator can stand up (or MITM if the client doesn't pin) converts to root on the hub-side appliance — treat VPN client configurations discovered during internal recon as attack-path seeds, and on authorized appliance engagements test whether the client accepts server-supplied config fields without identity gating beyond the server's own choice.
  • Validation boundary: lab-owned Fireboxes only; proof shape is config-handling evidence and version fingerprint (Fireware build), never against customer appliances. Generalizes alongside the page's KEV-precedent rule: IKE/IPsec perimeters were the audit target; TLS-tunnel client config parsers are the same class with the roles swapped.

Sweep implications

  1. Two of the eleven are parser/state-machine bugs in identity-adjacent fields (RouterOS username, btest related-channel) — the same "grammar check happens after the trust decision" pattern already documented on the wiki's library and appliance pages. RouterOS is a recurring engagement fixture: add username-syntax and pre-auth protocol-state probes to the network-internal checklist (lab-owned routers only).
  2. Cisco Secure Email Gateway joins the mail-security RCE class — a crafted email reaching a SQL/eval sink with root execution reframes email as an unauthenticated attack input, not just a phishing vector. For authorized assessments of mail infrastructure, this is now a first-class test target (synthetic messages, isolated appliances).
  3. JFrog's pair is the cleanest reusable lesson: validate scope-authorization and issuance-path separately from signature validity and feature flags. Both apply to any artifact registry, package proxy, or internal API gateway.
  4. NetScaler alternate-path bypass is the third-generation pattern (post-Citrix-FRAMESET era): sibling route-family enumeration, not just the flagship CVE route, is the durable validation workflow on NetScaler appliances.
  5. Cisco ISE extends the "API gateway ≠ management UI" class to the NAC tier. CVSS 10.0, unauthenticated, no workarounds, and active exploitation at KEV pace: an API endpoint's auth control diverged from the web-management interface it fronts, and Cisco's own IoC hunt lives in the ise-kong API-gateway access log. ISE/PIC is almost always in-scope on enterprise network assessments because it brokers NAC/VLAN/posture decisions — treat its API surface as a first-class enumeration target with per-route-family positive/negative controls, version fingerprint against the patch matrix (3.1 P12 / 3.2 P11 / 3.3 P12 / 3.4 P7 / 3.5 P4), and confine any active probing to lab appliances.

Validation boundaries

Ownership and lab discipline

Every product above is a customer perimeter device. Only test systems you own or have explicit written authorization to assess; prefer version/config fingerprinting for production, and confine any active validation to lab appliances with synthetic repos, marker files, and lab routers. Never read GitLab config/keys, never send crafted messages through production mail gateways, never exercise RouterOS privesc on operational networks.

October 3 follow-up: RouterOS webfig pre-auth integer-underflow root RCE (CVE-2026-84411)

  • GHSA-xj4h-hf2x-2q43 / CVE-2026-84411 (CVSS 9.8, ICSA-26-272-06): the RouterOS web management service contains an integer underflow in HTTP request-body handling that is reachable before authentication — a single crafted request yields arbitrary code execution as root (or DoS). Not yet in KEV as of catalog 2026.10.02; watch for addition.
  • Why it matters on this page: this is the third RouterOS trust-boundary hit this quarter after the two September KEVs (username-syntax policy-mask privesc CVE-2026-86060, pre-auth btest related-channel memory leak CVE-2026-67277). The pattern is now a product-level one: RouterOS splits its pre-auth attack surface across protocol parsers (SSH login grammar, Winbox/btest) and the HTTP management plane, and each family got its own boundary bug — an engagement checklist that probes only one family will miss the class.
  • Operator axes:
  • HTTP body-length arithmetic on management interfaces is a pre-auth memory-safety surface — same "length/size computed after the trust decision" grammar as the KEV'd btest underflow, now in the web path. Where the web interface is reachable (80/443/8080 defaults, often on WAN on consumer/SMB gear), version-fingerprint first (/jshttp/ routes, www-router banners, login.cgi presence) and confirm patch level against the MikroTik changelog rather than probing body-grammar on production.
  • Route-family parity applies inside one service too: this page's NetScaler lesson (enumerate sibling route families) has a webfig twin — the same HTTP server may front /rest/, api.php/rpc.php, and the login flow with different auth gates and different request parsers; test each independently.
  • ICSA-to-GHSA-to-KEV lag is your head-start window: the ICS advisory is public and GHSA is mirrored before KEV lands; perimeter appliances with ICSA + critical GHSA but no KEV yet are where the durable checklist updates come from (this page was built that way for CVE-2026-86060/67277).
  • Validation boundary: lab-owned RouterOS only for anything past fingerprinting; on authorized engagements, version evidence + reachability of the management plane is the report item, not crafted requests.

October 4 follow-up: NetScaler CTX697096 cluster detail + SAML-gated CVE-2026-88779 (CTX697174)

The Sept 27 zero-day pair (CVE-2026-88771 unauth RCE, CVE-2026-88772 DTLS-gated overflow, both KEV'd) shipped inside an eight-CVE bulletin, CTX697096, and on Oct 3 Citrix published CTX697174 / CVE-2026-88779 (CVSS 8.7, memory overflow → pre-auth DoS) as a fast-follow days after the exploited zero-days. Detail has now landed — the tracked wave on this product family converts into a durable checklist.

  • Citrix publishes the precondition as exact config patterns — the appliance config dump is the attack-surface map. CTX697096 names, per CVE, the show config lines that decide exposure: add vpn vserver ... SSL without -dtls OFF = CVE-2026-88772 applies (DTLS is on by default on VPN vServers); add lb vserver ... DTLS / add lb vserver <name> ORACLE = 88772/88776; LB/CS/VPN/auth vServers of type HTTP/SSL = smuggling CVE-2026-88773 (9.3) + URL-normalization policy-bypass CVE-2026-88774; non-HTTP L7 features on LB/CS/CGNAT-LSN/NAT64 = 88777; Enhanced ISN Generation disabled = TCP ISN-prediction CVE-2026-88778. On an authorized engagement, map each vServer in the customer's config to its applicable pre-auth sink family before touching anything — feature-precondition = attack-surface triage, and "flag absent = feature enabled" default-on gates (DTLS) are the easiest misses.
  • SAML config is the feature gate for CVE-2026-88779: exposure requires the appliance configured as SAML SP (add authentication samlAction) or SAML IdP (add authentication samlIdPProfile) — which is nearly every enterprise Gateway fronting Entra ID/Okta SSO. Availability-only impact, but unauthenticated, low-complexity, and no mitigation short of patching. Update (catalog 2026.10.04): CISA KEV'd CVE-2026-88779 the day after CTX697174 shipped (added 10-04, due 10-07, forensic-triage required, ransomware use "Unknown") — the "no in-the-wild activity yet reported" line in the advisory window lasted under 24 hours, so treat the SAML-gated pre-auth path as actively exploited, and note the KEV shortDescription still only claims DoS while the requiredAction demands forensics triage — KEV addition on an availability-classified CVE is CISA telling you the real impact chain is worse than the label. Operator value is twofold: (1) on perimeter assessments, samlAction/samlIdPProfile presence is a cheap version+config fingerprint that tells you whether the box is on the 14.1-73.41/13.1-64.28-or-later build line; (2) the same SAML-brokered AAA surface is where the deep identity axis lives — cross-reference the SAML assertion attack-surface methodology when SAML actions are present; the DoS CVE is the tripwire that says the SAML parser is actively being audited by others.
  • Two build lines in one week = per-CVE version fingerprinting. 14.1-73.37 (Sept 27) vs 14.1-73.41 (Oct 3): patch-level evidence must be the exact build, not the branch. Same rule as the Airflow per-advisory fingerprint: a box "on 14.1 latest last month" is still in range for the fast-follow CVE. Fingerprint builds via existing passive routes (/rns.js, redirect URL params) before claiming anything.
  • The bulletin's non-memory items feed two existing wiki classes: CVE-2026-88773 is a front-end-vs-origin desync candidate at the LB tier (pair with the Undertow/smuggling parser-differential methodology; single-connection canaries only, lab backends), and CVE-2026-88774 is URL-normalization-before-policy-evaluation — WAF/security-rule bypass grammar on the load balancer itself; test normalization differentials against policy-boundary routes with inert canary URLs.
  • Validation boundary: every item above is a production perimeter appliance. Config-pattern mapping comes from customer-provided config output or lab appliances; no crafted requests against live Gateways. Build/reachability evidence is the report item.

October 9 00:3xZ follow-up: CVE-2026-107406 — third SAML-gated NetScaler memory overflow, and the affected-range is the fingerprint (critical, GHSA-x62m-6223-4vq2)

Imported into GHSA 2026-10-09T00:31Z: another NetScaler ADC/Gateway memory overflow → RCE-or-DoS, again gated on SAML configuration, but with a stranger affected-range shape that carries its own operator lesson.

  • Two-sided version window: for IdP-only exposure (add authentication samlIdPProfile) the range is between builds — 14.1-73.37 through 14.1-73.41 inclusive, and 13.1-64.23 through 13.1-64.28 inclusive (plus FIPS/NDcPP twins). For SP-or-IdP exposure the range is before 14.1-73.37 / the older 13.1 lines. A bounded window that starts at the previous bulletin's fixed build means the fix itself regressed — the Sept 27→Oct 3 fast-follow pattern (88779) repeating: the remediation for the earlier SAML overflow reintroduced the class inside the same SAML code path.
  • Operator rules: (1) When a vendor ships fix N of a memory bug in a gated parser, treat builds [fix N .. fix N+1] as a second hunt window — regression CVEs live exactly in that interval, and a box "patched to the latest last week" is more exposed than one on the older line. (2) Per-Vserver samlAction/samlIdPProfile mapping from the Oct 4 leg above now decides which of the SAML CVEs applies — same config dump, three overflow legs, one SP/IdP role split. (3) Fingerprint evidence stays passive (build via existing routes, customer config output); no crafted requests against live Gateways. Not in KEV as of catalog 2026.10.13 — the 88779-style 24 h KEV fast-follow has not landed.
  • October 13 update — CISA reveals the 88779 role in the chain: it is a detonator, not a standalone DoS. CISA's amplified alert (updated 2026-10-09) states that in unpatched deployments threat actors "may also exploit CVE-2026-88779 to force a reboot and accelerate conditions to allow execution of code previously injected through exploitation of CVE-2026-88771." That confirms the operator read from the Oct 4 note (KEV-on-availability-label = real chain is worse): the SAML-gated overflow's field purpose is reboot-triggered activation of code already injected by the unauth RCE — a two-CVE chain where the low-severity-labeled leg is the persistence/trigger primitive. Durable rules: (1) when two KEVs on one product share a parser or feature gate, check whether the "DoS" one is the activation leg for the RCE one — reboot/power-cycle-triggered execution implies the implant survives restart (disk-resident or re-materialized at boot), which moves the forensic and validation question from "is it patched" to "what has been sitting on this box since before the patch date"; (2) for red-team/purple-team modeling on NetScaler estates, SAML-parser DoS traffic is not noise — on a vulnerable box it is the detonation signal and should be treated as a detection-and-triage event, and on assessments a device that rebooted unexpectedly near the pre-patch window is a compromise-indicator candidate to raise with the customer; (3) the chain makes passive build fingerprinting (/rns.js, redirect params) plus SAML-config evidence the correct report item — validation of 88771/88779 against live Gateways remains out of bounds.

October 12 follow-up: RouterOS WinBox EC-SRP cross-stage privilege install — stage-one identity verified, stage-two identity installed (CVE-2026-103903 / GHSA-23wm-v672-9cvc, 8.8)

Fourth RouterOS management-boundary hit this quarter, and the first post-auth-to-admin one reachable on the WinBox protocol itself (port 8291, frequently exposed alongside 80/443): GHSA-23wm-v672-9cvc / CVE-2026-103903 (CVSS 8.8, fixed 7.24.5 / 7.25rc1 per the MikroTik changelog and forum test thread).

  • The mechanism is a split-identity protocol bug: WinBox authentication runs EC-SRP in two stages. Stage one (challenge + proof) is verified against the attacker's own low-privilege account — crypto passes honestly. Stage two then carries an independently supplied username field, and the server installs that name's authorization policy into the session. Naming admin in stage two yields a full administrative session without knowing the admin password; the attacker can then persist the grant by editing their own account's privileges.
  • Durable sweep rule: in any multi-stage authentication handshake, every stage after the first that re-supplies identity must be bound to the stage that proved it. Fingerprint: protocol messages post-proof that contain a username/identity/role field the client still controls. This is the SRP/TLS-exporter/SSO-attestation generalization of the wiki's recurring "verification target ≠ enforcement target" invariant (cf. Airflow bearer-vs-cookie principal swap, FalkorDB delegated auth decision): the proof validated principal A while the session adopted principal B.
  • Black-box probe shape (lab routers only): authenticate with a low-priv account, observe the second protocol message carrying the identity (WinBox is a proprietary TCP protocol — raw-socket captures of your own lab session show the field), resubmit with a different existing username, then check print priv / effective policy. Decision table: same-name stage two = control; high-priv name = exploit; nonexistent name = how the server handles unknown identities (another oracle).
  • Engagement checklist update: this makes four RouterOS boundary bugs in ~5 weeks across three families — SSH username-grammar policy-mask (KEV), btest pre-auth leak (KEV), webfig HTTP-body underflow RCE (ICSA, not KEV'd as of catalog 2026.10.08), and now WinBox SRP stage-split privesc. Standing network-pentest rule holds: on any MikroTik finding, sweep all management protocols (SSH/WinBox 8291/API 8728/API-TLS 8729/WebFig) as separate surfaces; a low-priv legitimate credential is now a full-admin candidate on 8291, so credential-hunting against SMB gear pays multiplicatively.
  • Validation boundary: lab-owned RouterOS only for the handshake probe; on authorized engagements, version evidence against the 7.24.5 changelog line + 8291 reachability is the report item. Not in KEV as of catalog 2026.10.08.