Today’s digest is dominated by three maximum-or-near-maximum severity bugs that all reached active exploitation within days of disclosure, plus a researcher openly feuding with a major vendor over disclosure practices. Here’s what’s new since yesterday’s digest.
Vulnerability watch: CISA gives federal agencies until today to patch a CVSS 10.0 Cisco firewall manager bug already linked to Sandworm and Qilin
CISA added three actively exploited flaws to its Known Exploited Vulnerabilities catalog — in Cisco, Citrix, and Fortinet products — and set September 12, 2026 (today) as the patch deadline for Federal Civilian Executive Branch agencies. The headline bug is CVE-2026-20079 (CVSS 10.0), a pre-authentication remote code execution flaw in Cisco Secure Firewall Management Center caused by a static boot-time session ID combined with hardcoded machine credentials baked into the FMC software — letting an unauthenticated remote attacker run commands as root with no workaround available. Cisco’s PSIRT confirmed active exploitation in August, though shared indicators of compromise with a related bug (CVE-2026-20316, disclosed July 29) suggest exploitation began as early as July 23. Cisco Talos has tied the ongoing campaign to activity overlapping with the Russia-linked Sandworm group and a Qilin ransomware affiliate. The same KEV batch adds CVE-2026-19490 (CVSS 9.3), an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway, and CVE-2025-25249, a heap-based buffer overflow across multiple Fortinet products. BleepingComputer · Cisco Talos · CISA
If you run Secure Firewall Management Center, NetScaler ADC/Gateway, or the affected Fortinet products anywhere in your estate, treat today’s federal deadline as your own: there’s no workaround for the Cisco bug, and a nation-state group and a ransomware affiliate are both already using it.
Vulnerability watch: A CVSS 10.0 GitLab file-read flaw is under active probing barely a day after disclosure
GitLab patched CVE-2026-85706, a maximum-severity path traversal vulnerability in the repository commits API of GitLab Community Edition and Enterprise Edition, in versions 19.1.8, 19.2.6, and 19.3.2. Improper path confinement combined with missing authentication enforcement on the affected endpoint lets an unauthenticated attacker read arbitrary files off the GitLab server — including log files and configuration files that can hand over credentials and other secrets. The flaw affects self-hosted instances running 18.7 up to (but not including) 19.1.8, 19.2 up to 19.2.6, and 19.3 up to 19.3.2. Researchers report attackers had already reverse-engineered and reproduced the bug within a day of the advisory, and CISA added it to its KEV catalog on September 11. The Hacker News · watchTowr · SC Media
Self-hosted GitLab is exactly the kind of internet-facing dev infrastructure that gives an attacker source code, CI secrets, and a foothold into your build pipeline in one shot. If you run CE or EE on-prem, patch now — the window between disclosure and mass scanning on this one is measured in hours, not weeks.
Supply chain watch: Attackers chain two JFrog Artifactory bugs to mint admin tokens and drop Rust-based backdoors
Cloud security firm Wiz confirmed active exploitation of a two-bug chain in self-hosted JFrog Artifactory instances between August 15 and September 8. Attackers first exploit CVE-2026-42018 to obtain a JSON Web Token belonging to Artifactory’s internal anonymous user — even on instances where anonymous access is disabled — then escalate to full admin privileges via CVE-2026-42016, caused by insufficient token validation. With admin access, attackers create new admin accounts, generate long-lived access tokens, and install malicious Groovy plugins to execute arbitrary commands, before deploying a custom Rust-based backdoor with command-and-control capabilities for persistence. A third flaw, CVE-2026-82329 — a critical authentication bypass separately observed under exploitation by watchTowr — offers attackers another path to minting admin tokens. Post-exploitation, actors have staged payloads in /dev/shm, /tmp, and /var/tmp, dropped webshells, exfiltrated Artifactory configuration data and cluster join keys, and added their own SSH keys to newly created accounts. BleepingComputer · The Hacker News
Artifactory sits at the center of most build pipelines — an admin-level compromise there is a direct path to a software supply chain attack against everything your org ships. If you self-host Artifactory, patch both CVEs, audit for unexpected admin accounts and long-lived tokens created since mid-August, and check for unfamiliar Groovy plugins.
Also noted
A researcher operating under the handle Nightmare Eclipse (also known as Chaotic Eclipse) released a third consecutive Microsoft Defender zero-day, dubbed “ShieldCrash,” timed to land right after this month’s Patch Tuesday. ShieldCrash bypasses “ShieldBreak,” a Defender privilege-escalation flaw Microsoft patched just days earlier — which itself bypassed “RoguePlanet,” a Defender bug disclosed in June and patched in July. The proof-of-concept grants SYSTEM-level arbitrary file read (not full write access or a shell) on fully patched Windows 10, 11, and Server systems. The researcher says the releases are a deliberate protest against Microsoft’s bug bounty and disclosure practices; Microsoft has responded with warnings of legal action over “malicious activity causing real harm.” BleepingComputer · The Register · SecurityWeek
Three bypasses of the same Defender component in three months means the underlying design flaw hasn’t actually been fixed yet — patching each named exploit as it drops isn’t the same as closing the class of bug. If SYSTEM-level file-read on Defender endpoints matters to your threat model, watch this one for a real fix, not just another patch-and-bypass cycle.
Final thought
Three unrelated products, three near-maximum CVSS scores, and the same pattern each time: disclosure to active exploitation in days, sometimes hours. Patch Cisco Secure FMC, NetScaler, and the named Fortinet products against today’s KEV deadline, get self-hosted GitLab and Artifactory current, and audit both for signs of compromise since mid-August rather than assuming you caught it in time. If you want help checking whether your detections would actually catch exploitation of any of today’s bugs, see our how-to guides or book a discovery call.