Exploited Linux Kernel Flaws, Cisco Zero-Days, and a Seven-CVE KEV Week

Seven vulnerabilities entered CISA's Known Exploited Vulnerabilities catalog during the week, down from 14 the prior week. But the smaller number should not be mistaken for a quiet threat environment.

The additions included a CVSS 10.0 authentication bypass in Cisco Identity Services Engine, a 9.8 SQL injection vulnerability in Cisco Secure Email Gateway capable of root-level command execution, an exploited Google Pixel modem vulnerability, an Acronis privilege-escalation issue, and three Linux kernel vulnerabilities whose original disclosures predated their September 18 elevation to KEV.

The larger lesson is about prioritization. Several vulnerabilities with confirmed exploitation had relatively modest EPSS probabilities at the end of the reporting period. Exploitation evidence, internet exposure, asset criticality, exploit automation, and post-exploitation impact therefore remain important context alongside CVSS and EPSS.

The Week at a Glance

CISA-derived KEV data shows seven additions for September 14–20 compared with 14 for September 7–13, producing the 50% decline in weekly KEV intake. This is a volume metric, not evidence that overall cybersecurity risk declined.

The average EPSS value is a September 20 snapshot and should be interpreted carefully because EPSS changes daily. The mean is also materially lifted by CVE-2026-58138, which carried an EPSS of roughly 9.14%. EPSS estimates exploitation probability; it does not override direct evidence that a vulnerability has already been exploited.

Seven Vulnerabilities Entered CISA KEV

The week's KEV activity occurred in three waves:

• September 14: 1 vulnerability
• September 16: 3 vulnerabilities
• September 18: 3 vulnerabilities

The resulting seven-CVE cohort is confirmed by CISA-derived KEV data.

*CVSS calculations in this report use vendor/CNA CVSS v3.x scores where available to maintain consistency. CVE-2025-39682 is an example where scoring authorities differ; organizations should ultimately use the severity and applicability guidance provided by the Linux distribution supporting the affected system.

New Vulnerabilities vs. Older Vulnerabilities Newly Elevated to KEV

One of the most important distinctions this week is that a new KEV entry does not necessarily mean a newly disclosed vulnerability.

Newly disclosed or published during the reporting window

CVE-2026-76461 — Cisco Secure Email Gateway

Cisco published the advisory September 14. The vulnerability results from insufficient validation in email parsing and allows an unauthenticated attacker to send a crafted message containing malicious SQL statements. Successful exploitation can lead to arbitrary command execution with root privileges. Cisco assigned CVSS 9.8, reported no workaround, and released fixed software.

CVE-2026-76460 — Cisco Identity Services Engine

Cisco disclosed the vulnerability September 16 with the maximum CVSS 10.0 rating. An unauthenticated remote attacker can abuse a vulnerable API to bypass authentication on Cisco ISE or ISE-PIC. CISA added it to KEV the same day and set a September 19 federal remediation date.

CVE-2026-58704 — Google Pixel

Google's September Pixel bulletin said there were indications that CVE-2026-58704 was undergoing limited, targeted exploitation. The issue affects the modem and is classified as a high-severity elevation-of-privilege vulnerability. Google directed supported Pixel devices to the 2026-09-05 security patch level or later.

CVE-2026-87886 — Acronis Backup

This Linux issue permits local privilege escalation because of insecure file permissions. Affected products include older builds of the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin. Interestingly, CISA's KEV date of September 16 preceded the formal CNA publication timestamp on September 17, demonstrating how operational exploitation intelligence can sometimes move faster than normal CVE publication workflows.

Older vulnerabilities newly elevated to KEV

The three Linux vulnerabilities added September 18 were not newly discovered that day.

CVE-2025-39682 was originally published in September 2025 and involves unusual state handling in the Linux kernel TLS receive path.

CVE-2026-53266 was disclosed in June 2026 and is an out-of-bounds write affecting the Linux kernel ebtables SNAT implementation. CISA added it to KEV on September 18 with a September 21 remediation date.

CVE-2025-39964 concerns concurrent writes to AF_ALG cryptographic sockets, creating inconsistent internal state and potentially corrupting cryptographic operations or causing a denial of service. Its original Linux disclosure predates this week's KEV designation.

This is precisely why vulnerability programs should continually enrich existing inventories with new threat intelligence rather than assuming an older CVE's priority remains static.

Threat Theme #1: Security Infrastructure Is Part of the Attack Surface

Two of this week's CISA-confirmed exploited vulnerabilities affected technology organizations deploy specifically to improve security.

Cisco Secure Email Gateway sits in the path of inbound and outbound email. CVE-2026-76461 potentially allows a crafted email to progress from SQL injection to operating-system commands running as root.

Cisco ISE is commonly positioned around network access control and identity enforcement. CVE-2026-76460 allows an unauthenticated attacker to bypass authentication on affected systems.

September 16 was also much broader than a single ISE vulnerability. Cisco published a substantial security update cycle affecting Secure Firewall Management Center, ASA, FTD and related infrastructure, including multiple critical issues.

The operational takeaway is simple: security appliances cannot be excluded from vulnerability-management coverage just because they are themselves security controls.

Threat Theme #2: Three Linux CVEs Became Urgent Overnight

Linux accounted for three of the seven KEV additions.

That does not mean every Linux server is vulnerable. Kernel version, distribution backports, loaded modules, configuration and workload all matter.

It does mean organizations with large Linux estates should be able to answer several questions quickly:

• Which systems are running affected kernels?
• Which are internet-facing?
• Which support externally accessible applications?
• Which are business-critical?
• Which already have distribution-provided fixes?
• Which systems were exposed before remediation?
• Can remediation be verified against the running kernel, rather than merely the installed package?

For CVE-2026-53266, for example, the kernel CVE record describes the ebtables SNAT out-of-bounds write while CISA explicitly classifies the issue as known exploited and gives it a September 21 deadline under federal guidance.

For CVE-2025-39964, Red Hat additionally documents disabling the AF_ALG module as a potential mitigation where appropriate, although organizations should follow their own Linux distribution's guidance rather than applying generic kernel changes independently.

Threat Theme #3: EPSS and KEV Answer Different Questions

This week's data gives a useful example of why vulnerability prioritization cannot depend on one score.

Several vulnerabilities confirmed as exploited through CISA KEV had relatively low EPSS probabilities around September 20. The seven-KEV cohort averaged only about 0.8% EPSS, despite every member meeting CISA's criteria for evidence of real-world exploitation.

That is not necessarily a failure of EPSS.

EPSS asks approximately:

How likely is this CVE to be exploited in the next 30 days?

KEV answers a different question:

Is there sufficient evidence that exploitation has already occurred?

CVSS answers yet another:

How severe could successful exploitation technically be?

None of these describes the organization's actual exposure by itself.

A more useful prioritization model combines:

Known exploitation + external exposure + asset importance + exploitability + technical impact + compensating controls + remediation status.

That structure closely resembles the factors CISA now uses under BOD 26-04, which specifically considers asset exposure, KEV status, exploit automation and technical impact.

Additional Significant Vulnerabilities to Watch

The CISA KEV catalog was not the entire vulnerability story this week. Four additional issues were significant enough to include in the broader analysis without counting them as new CISA KEV additions.

CVE-2026-89026: Issabel PBX

Published September 15, CVE-2026-89026 involves a hard-coded HS256 JWT signing key in Issabel Framework. An unauthenticated attacker capable of forging a valid token can invoke functionality that ultimately causes arbitrary operating-system commands to run through Asterisk. Public reporting tied exploitation evidence to activity first observed September 9. The flaw was fixed through Issabel commit b97dbaf.

CVE-2026-20242: Cisco Secure Firewall Management Center

Cisco disclosed this CVSS 9.8 Java deserialization vulnerability on September 16. An unauthenticated remote attacker can potentially execute arbitrary commands as root when the External Database Access feature is enabled and at least one host is configured in its access list. Cisco reported no workaround and released software fixes.

CVE-2026-58138: Orkes Conductor

CVE-2026-58138 was disclosed before this reporting window, so it is not counted as a newly disclosed CVE. It is included because new exploitation intelligence surfaced during the week.

FortiRecon reported on September 18 that the Orkes Conductor evaluator RCE was being exploited and that working exploit code existed. Its EPSS was approximately 9.14%, dramatically higher than most of this week's CISA KEV cohort. It was not in CISA KEV at the close of the reporting period.

This is a useful reminder that KEV is authoritative for vulnerabilities CISA has validated, but it is not intended to represent every exploitation event occurring globally in real time.

Industries Potentially Most Affected

Federal Government and Federal Cloud Providers

This group has the clearest operational connection to the week's developments.

CISA's BOD 26-04 requires covered Federal Civilian Executive Branch agencies to prioritize remediation using asset exposure, KEV status, exploit automation and technical impact. The directive replaced the previous BOD 22-01 approach and also establishes forensic-triage requirements in designated circumstances.

FedRAMP is likewise transitioning toward Vulnerability Detection and Response and Vulnerability Evaluation and Reporting requirements, with mandatory adoption scheduled for December 7, 2026 and a grace period through March 7, 2027. FedRAMP's VDR rules explicitly address KEV remediation according to CISA deadlines.

Critical Infrastructure and Large Enterprises

Organizations operating sizable Linux estates, security appliances and externally accessible management infrastructure may have the largest investigation scope. Linux kernel exposure can cross servers, virtual infrastructure, appliances and specialized systems.

The priority should be determining whether affected versions actually exist and where those systems sit within the attack surface, rather than treating Linux presence alone as proof of exposure.

Managed Service Providers and Hosting Providers

CVE-2026-87886 specifically affects older Acronis Backup integrations for cPanel, Plesk and DirectAdmin, technologies commonly encountered in hosting and managed environments.

Multi-tenant infrastructure raises the importance of quickly linking vulnerable software to customers, service owners and remediation accountability.

Healthcare

Healthcare organizations may operate combinations of Linux servers, network-security appliances, mobile devices and externally accessible systems.

HHS OCR explicitly recommends that HIPAA-regulated entities monitor authoritative vulnerability sources including NVD and CISA KEV, maintain accurate asset inventories and incorporate unpatched vulnerabilities into HIPAA Security Rule risk analysis and risk-management activities.

Financial Services and Payment Environments

For organizations subject to PCI DSS, Requirement 6.3.3 establishes patching expectations including installation of updates for critical vulnerabilities within one month, while Requirements 11.3.1 and 11.3.1.1 address resolution of critical and high-risk vulnerabilities. PCI SSC also makes clear that organizations should evaluate vulnerability severity in the context of their own environment rather than blindly inheriting an external risk ranking.

Unified Communications and Contact Centers

Issabel's connection to PBX and Asterisk environments makes CVE-2026-89026 particularly relevant to organizations or providers operating Issabel-based communications infrastructure.

DevOps and Workflow Automation Teams

The reported exploitation of Orkes Conductor should draw attention from organizations using workflow-orchestration systems that have access to internal APIs, service accounts or automation credentials. A compromise of the orchestration layer can have consequences beyond the vulnerable application itself.

Regulatory and Framework Considerations

These vulnerabilities do not automatically mean an organization is noncompliant. The more important issue is whether its vulnerability-management processes can identify, prioritize, remediate and document relevant exposure.

CISA BOD 26-04: Binding on applicable federal civilian agencies. Its prioritization model explicitly incorporates external exposure, KEV status, exploit automation and technical impact. CISA encourages non-federal organizations to adopt similar risk-based practices, but the directive itself should not be presented as a commercial compliance requirement.

FedRAMP: The 2026 Vulnerability Detection and Response model pushes federal cloud providers toward persistent vulnerability detection, validation and KEV-aware remediation.

HIPAA Security Rule: HHS OCR guidance connects vulnerability management, system hardening, asset inventory and patching to risk analysis and risk management for systems protecting ePHI.

PCI DSS 4.x: Vulnerability risk ranking, patch-management timelines and resolution of critical/high vulnerabilities remain relevant for systems inside or affecting the cardholder-data environment.

NIST Cybersecurity Framework 2.0: The events reinforce the broader CSF lifecycle: identify assets and exposure, protect through remediation and hardening, detect potential exploitation, respond where compromise is suspected and verify recovery.

Regulatory applicability depends on the organization, system and jurisdiction. These observations are cybersecurity-operational context rather than legal advice.

Defensive Priorities for the Week

1. Reconcile KEV against the asset inventory. Immediately map all seven new KEVs against software inventories, vulnerability data, cloud workloads, appliances, mobile fleets and supported Linux distributions.
2. Prioritize exploitation evidence over score chasing. Do not demote a confirmed KEV merely because EPSS appears low. Conversely, a high CVSS score without exposure does not automatically make a vulnerability the organization's highest operational risk.
3. Identify internet-facing and management-plane systems. Pay particular attention to ISE, Secure Email Gateway, firewall-management infrastructure and other administrative interfaces. Reduce unnecessary external accessibility and restrict management sources wherever possible.
4. Apply vendor-supported fixes rather than generic patches. Cisco released fixed software for the SEG, ISE and FMC vulnerabilities. Google directs supported Pixel devices to the September 2026 patch level. Acronis provides minimum fixed builds for affected integrations. Linux administrators should use distribution-supported kernel packages and vendor advisories rather than indiscriminately cherry-picking upstream commits.
5. Hunt before declaring victory where active exploitation occurred. Patching stops future exploitation; it does not prove the system was not compromised beforehand. CISA's BOD 26-04 implementation guidance specifically introduces forensic-triage expectations for designated high-risk scenarios.
6. Verify remediation. Confirm the running software or kernel version after maintenance, verify mobile security patch levels, rescan affected systems and document approved exceptions or compensating controls.
7. Preserve remediation evidence. Maintain records linking the vulnerable asset, CVE, owner, exposure state, remediation activity, validation result and closure date. This is useful operationally and supports compliance and audit workflows.

CVE / Threat Word Cloud

What Defenders Should Take Away

The most important statistic this week is not that KEV additions fell 50%.

It is that seven vulnerabilities moved from vulnerability-management records into a category backed by evidence of real-world exploitation, while other exploited vulnerabilities remained outside CISA KEV.

The Linux additions demonstrate how an older CVE can suddenly become operationally urgent. The Cisco vulnerabilities show that identity, email-security and firewall-management platforms are themselves high-value attack surfaces. And the Pixel, Issabel and Orkes cases illustrate how endpoint, communications and application infrastructure can enter the threat picture simultaneously.

The practical objective is therefore not simply to “patch more.”

It is to be able to answer, quickly and defensibly:

That is the difference between vulnerability scanning and vulnerability risk management.

Methodology and Data Notes

This briefing covers September 13 through September 20, 2026. Vulnerabilities were included when a relevant disclosure, CISA KEV addition or material exploitation signal occurred during that period. Older vulnerabilities were not added simply to increase story count.

The primary scorecard contains 11 CVEs: seven vulnerabilities newly added to CISA KEV plus four significant supplemental vulnerabilities. Cisco published additional vulnerabilities during its September 16 security update cycle; those are acknowledged as broader context but intentionally excluded from the scorecard to maintain a meaningful denominator.

Severity calculations use vendor/CNA CVSS v3.x scores where available. EPSS values represent approximately September 20, 2026 and can change daily.

“Known exploitation” in the metrics includes CISA KEV confirmation plus additional exploitation supported by cited public threat-intelligence sources. It does not imply knowledge of specific victims, threat actors or exploitation volume unless those details have been independently established.

Week-over-week analysis is limited to CISA KEV additions, where reliable comparable data exists: seven additions during September 14–20 versus 14 during September 7–13. Other week-over-week comparisons are reported as N/A rather than inferred or fabricated.