Top 5 Cybersecurity News

This week’s Top 5 Cybersecurity News keeps returning to the same uncomfortable pattern: the systems under attack are not the ones organizations watch closely, they’re the ones organizations trust by default. Identity platforms, remote-support tools, developer infrastructure, and mobile devices all exist specifically so that legitimate work can move faster and with less friction. This week, all four became the attack surface, and a new EU reporting regime arrived to make sure that stops being a private, technical decision.

1) Cisco’s Identity Backbone Gets a Zero-Day It Can’t Ignore

Cisco patched CVE-2026-76460, a maximum-severity authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and its Passive Identity Connector, after confirming attackers were already exploiting it against unpatched systems in the wild. The flaw sits in an API endpoint that unauthenticated attackers could reach directly; in successful exploitation, it let them access the management interface and, in some cases, execute commands with root privileges — full administrative control of the platform, achieved without ever presenting valid credentials.

ISE is not a peripheral tool. It is the layer many enterprises rely on to decide, in real time, which devices and users are allowed onto the network in the first place, the mechanism behind network access control and identity enforcement across wired, wireless, and VPN connections. A bypass at that layer does not just expose one system: it calls into question every access decision ISE has made since the vulnerability became exploitable, because there is no reliable way to distinguish a legitimate device from one an attacker registered through the bypass. CISA gave federal agencies until September 19 to patch; for everyone else, an internet-reachable ISE management interface should be treated as compromised until logs prove otherwise, with administrative access logs reviewed specifically for authentication events that don’t match known accounts.

The lesson extends beyond this one product. Identity and access-control platforms are built to be trusted by definition, that is their job, which makes them exceptionally high-value targets and, in day-to-day operations, exceptionally under-scrutinized ones. Assuming an identity platform’s own security posture is self-evidently solid, rather than subjecting it to the same patching discipline, log review, and exposure management as any other internet-facing system, is precisely the assumption this vulnerability class exploits.

CVE-2026-76460 is a CVSS 10.0 authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector that is being actively exploited; CISA added it to its Known Exploited Vulnerabilities catalog on September 16, 2026, with a federal remediation deadline of September 19.

2) When the Remote-Support Tool Becomes the Attacker’s Tool

CISA added CVE-2026-84869, a critical ConnectWise ScreenConnect vulnerability, to its Known Exploited Vulnerabilities catalog after Huntress documented several intrusions in which attackers abused active remote-support sessions to push malicious scripts to newly connected endpoints. The underlying flaw is an authorization gap in how ScreenConnect handles file transfers between a technician’s console and a connected machine, on its own a fairly ordinary class of bug.

What makes it dangerous is the setting it operates in. ScreenConnect exists specifically so IT staff and managed service providers can act on remote machines with trust already established between the parties; attackers exploiting this flaw don’t need to breach that trust relationship from outside, they ride in on a channel the organization itself built for legitimate remote access. That is exactly why the resulting activity blends so easily into ordinary support work and evades detection that assumes remote-support traffic is inherently benign. Organizations running ScreenConnect, especially MSPs managing many client environments through it, should treat this as a session-audit problem as much as a patching one: reviewing recent file-transfer activity and session logs for anomalies, not only applying the update.

The broader pattern here runs through this week’s other stories as well: attackers increasingly prefer to operate inside channels an organization already trusts rather than force their way through channels it actively defends. A remote-support tool is, by design, a backdoor with permission, which is exactly what makes it worth protecting as carefully as any perimeter control, not less.

CVE-2026-84869 is a critical ConnectWise ScreenConnect vulnerability that lets an attacker abuse active remote-support sessions to transfer and execute files without authorization; CISA added it to its Known Exploited Vulnerabilities catalog on September 11, 2026.

3) GitLab’s Second Maximum-Severity Flaw in Six Weeks Exposes the Developer Pipeline

GitLab shipped emergency patches for CVE-2026-85706, a maximum-severity path-traversal flaw in its Repository Commits API, present in self-managed Community and Enterprise Edition instances, that can expose configuration files, application logs, credentials, and other secrets to an attacker who never needed valid repository access. Internet-wide scanning for vulnerable instances began within hours of public disclosure, and CISA added the flaw to its exploited-vulnerabilities catalog days later, confirming it was already being used against real targets rather than merely tested in labs.

This is GitLab’s second maximum-severity, actively exploited flaw in six weeks, following CVE-2026-19478 in late August, a pattern that turns what might otherwise read as a one-off incident into a signal that self-hosted developer platforms are now a standing, recurring target rather than an occasional one. Because the exposure here is credentials and secrets rather than just code execution, patching the software is necessary but not sufficient: any instance that was internet-reachable before the patch needs a credential rotation across everything the exposed configuration files and logs could have revealed, on the assumption that anything readable was read.

The wider lesson is that developer infrastructure now carries the same operational weight as production infrastructure and needs to be defended accordingly. A repository platform is not just a place code is stored; it is a place where credentials, secrets, and the keys to a much larger environment tend to accumulate over time, often without anyone deliberately deciding to put them there.

CVE-2026-85706 is a maximum-severity path-traversal vulnerability in GitLab’s Repository Commits API that can expose configuration files, logs, and credentials from self-managed instances; GitLab shipped emergency patches on September 10, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog days later.

4) Europe’s Cyber Resilience Act Reporting Clock Starts Now

September 11 marked the start of mandatory incident and vulnerability reporting under the EU Cyber Resilience Act. Manufacturers of products with digital elements must now notify actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware of them, submitted through ENISA’s new single reporting platform; Germany’s BSI and CERT-Bund hold central coordinating roles for German manufacturers under the new regime.

Operationally, this changes what “finding a vulnerability” means for any organization that builds or ships connected products into the EU market. The technical stories elsewhere in this list, Cisco ISE, ScreenConnect, GitLab, and, further below, a Pixel modem flaw, are exactly the category of actively exploited, high-severity finding the CRA now expects to be formally reported on a fixed clock, rather than quietly patched, disclosed at a vendor’s own pace, or left undocumented internally. Vulnerability handling has just acquired a compliance deadline attached to it, enforced separately from the technical fix itself.

The strategic lesson is that vulnerability management is no longer a purely internal, technical decision a security team can resolve on its own timeline. It is now a governance obligation with legal consequences for missing the window, which means the process for detecting, assessing, and escalating a vulnerability needs to be fast and well-documented enough to survive a regulator’s later review, not just fast enough to get a patch out the door.

Mandatory incident and vulnerability reporting under the EU Cyber Resilience Act began on September 11, 2026; manufacturers of products with digital elements must now report actively exploited vulnerabilities and severe incidents within 24 hours through ENISA’s new Single Reporting Platform.

5) A Modem Flaw Turns Pixel Phones Into a Targeted Surveillance Vector

Google’s September Pixel update fixed 110 vulnerabilities, including CVE-2026-58704, a flaw in the device’s modem component that Google says shows signs of limited, targeted exploitation rather than broad criminal use. CISA added it to its Known Exploited Vulnerabilities catalog on September 16 with a September 19 remediation deadline. The bug allows privilege escalation from an adjacent network without any user interaction: no click, no download, no visible sign anything happened.

That combination, no interaction required and evidence of narrow, deliberate use rather than mass exploitation, is the signature of surveillance-oriented tooling rather than opportunistic cybercrime. It also makes this the useful outlier on this list: everything else here concerns infrastructure that IT teams manage and monitor directly, while this affects a personal device that executives, journalists, and administrators carry in their pockets, frequently with far less security oversight and update discipline than a managed server or laptop ever receives.

The lesson is about where oversight actually stops. Organizations spend considerable effort securing the infrastructure they control directly and comparatively little verifying that the mobile devices carried by the people with the most sensitive access are patched, monitored, and treated as part of the same threat model, even though, for a small number of high-value targets, the phone in their pocket may be the softest point of entry into everything else.

CVE-2026-58704 is a modem-component flaw in Google Pixel devices that Google says shows signs of limited, targeted exploitation; CISA added it to its Known Exploited Vulnerabilities catalog on September 16, 2026, with a remediation deadline of September 19.

If this week tells us anything, it’s this:

Five stories, five different layers, one shared shape: attackers are not breaking down the front door so much as walking through the side entrances organizations built for their own convenience — an identity platform meant to enforce access, a remote-support tool meant to enable it, a developer platform meant to accelerate it, and a mobile device meant to extend it everywhere. None of these systems failed because someone stopped watching them; they failed because they were trusted by default, and default trust is precisely what attackers now know to target first.

The regulatory response arriving alongside these incidents, the EU Cyber Resilience Act’s new reporting clock, is a signal in its own right: the assumption that vulnerability handling is a private, technical matter is no longer holding, in Brussels or in Bonn. Organizations that treat this week’s five stories as isolated patches will fix five bugs. Organizations that treat them as one pattern — trusted infrastructure needs the same scrutiny as untrusted infrastructure — will fix the actual problem.

If any of this week’s five stories raises questions about your own environment, get in touch with DIESEC.