Reporting Convention
New this week refers to vulnerabilities, exploits, or incidents disclosed between September 9–16. Active-exploitation update signifies an older vulnerability that has new evidence of exploitation, KEV additions, updated remediation, or significant reporting. New reporting highlights research on earlier campaigns published during this period.
The Week in One Line
GitLab disclosed and patched a CVSS 10 commits-API path-traversal flaw on September 10, followed shortly by exploitation reporting and KEV listing; Cisco disclosed an actively exploited SQL injection in Secure Email Gateway on September 14; and September 16 added urgent identity and API-management risks, including Cisco ISE API/REST vulnerabilities, exploitation attempts against WSO2 API Manager, an actively exploited Issabel PBX JWT flaw, and a WordPress REST API authorization issue in MultiVendorX.
Key Takeaways
- GitLab CVE-2026-85706 was a genuine in-window disclosure and patch event: fixes shipped September 10, exploitation/probing was reported shortly afterward, and CISA added it to KEV September 11.
- Cisco Secure Email Gateway CVE-2026-76461 was disclosed September 14 with Cisco-confirmed active exploitation. A crafted email can trigger root command execution on affected AsyncOS appliances.
- September 16 materially expanded the identity/API risk picture: Cisco ISE disclosed an API authentication bypass plus REST API authorization, path-traversal, and injection issues; WSO2 API Manager exploitation attempts targeted forged privileged JWTs.
- Issabel Framework CVE-2026-89026 is actively exploited. Its hard-coded JWT signing key can permit forged tokens and unauthenticated command execution against PBX systems.
- Cisco FMC, JFrog Artifactory, Citrix NetScaler, VMware vCenter, PaperCut, Marimo, and AI-token theft are included as exploitation updates or as new reporting on older vulnerabilities/campaigns—not as new September disclosures.
- MultiVendorX CVE-2026-74926 illustrates a recurring API weakness: insufficient object-level authorization in a WordPress REST route can allow authenticated users to modify stores they do not own.
New Disclosures and Confirmed Exploitation
Active-Exploitation Updates and KEV Escalation
Deep Dives: The Flaws That Matter
GitLab: commits-API path traversal (CVE-2026-85706, CVSS 10.0)
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10 to address CVE-2026-85706, a critical path traversal in the repository commits API. Under affected conditions, an unauthenticated attacker can read arbitrary files from a self-managed GitLab CE/EE server.
Exploitation and widespread probing were reported shortly after disclosure, and CISA added the CVE to KEV on September 11. Exposure can include configuration, access tokens, CI/CD variables, encryption material, and database credentials.
Affected: GitLab 18.7–19.1.7, 19.2.0–19.2.5, and 19.3.0–19.3.1. Fixed: 19.1.8, 19.2.6, and 19.3.2.
Action: Upgrade immediately. Restrict public access where feasible, review commits-API/web logs for traversal attempts, rotate secrets readable by GitLab, and audit user, token, runner, project, CI/CD-variable, and administrative changes.
Cisco Secure Email Gateway: SQL injection through crafted email (CVE-2026-76461, CVSS 9.8)
Cisco disclosed CVE-2026-76461 on September 14 in AsyncOS Software for Cisco Secure Email Gateway. Cisco states that insufficient validation in email parsing allows an unauthenticated remote attacker to send a crafted email containing malicious SQL statements and execute arbitrary commands with root privileges on the underlying operating system.
Cisco stated it is aware of active exploitation. The issue affects physical and virtual appliances regardless of configuration, and Cisco said no workaround addresses the vulnerability.
Action: Upgrade to the first fixed AsyncOS release for the installed branch: 15.5.5-0141, 16.0.4-3021, or 16.5.0-780. Follow Cisco’s upgrade guidance, then review mail-routing changes, users, administrative activity, message-processing events, configuration, and outbound connections.
Cisco ISE: API and REST management-interface vulnerabilitie
Cisco published multiple Identity Services Engine (ISE) and ISE Passive Identity Connector advisories on September 16. CVE-2026-76460 is an API authentication-bypass vulnerability that can allow an unauthenticated remote attacker to bypass authentication due to insufficient authentication controls in an API.
CVE-2026-76423 affects the REST API and can allow unauthenticated remote administrative access due to insufficient authorization.CVE-2026-76424 is an authenticated REST API arbitrary-file access/write vulnerability caused by insufficient validation in file operations.
Action: Apply Cisco ISE updates, restrict management and REST API access to controlled networks, audit administrator/API activity, review for unauthorized file writes and configuration changes, and rotate credentials if compromise indicators are found.
WSO2 API Manager: forged JWTs target API-management control planes (CVE-2026-5430)
Active exploitation attempts targeting CVE-2026-5430 in WSO2 API Manager were reported on September 16. The flaw allows attackers to forge JWTs carrying administrator privileges, creating a potential account-takeover path against API-management services.
API-management control-plane compromise can affect API definitions, publishing, gateway policies, developer portals, credentials, and connections to backend services. The report should treat the exploitation intelligence as an in-window update; confirm affected versions and patch instructions from WSO2’s official advisory before deployment.
Action: Patch affected WSO2 products, inventory exposed management/publisher/developer-portal/gateway interfaces, review JWT validation and administrator activity, rotate signing material and privileged credentials as appropriate, invalidate suspicious sessions, and audit API policy/configuration changes.
Issabel PBX: hard-coded JWT key enables unauthenticated command execution (CVE-2026-89026)
CVE-2026-89026 affects the Issabel Framework used by Issabel PBX. A hard-coded HS256 JWT signing key in pbxapi/index.php is identical across installations before the fixed commit, allowing attackers to forge tokens and execute operating-system commands without authentication.
Reports from September 15–16 indicated that a flaw was actively exploited. The signing key, embedded in the framework and reused in various installations, allows attackers to generate their own JWTs if they find an exposed PBX API. This could lead to unauthorized command execution, access to the PBX host, and exposure of call-processing systems, configuration data, credentials, and other connected services. The affected framework is fixed at or after commit
b97dbaf0b71c1c36f841e672b664afbeb02773bd
Action: Update Issabel Framework to the fixed revision or later, reduce external exposure to PBX APIs, rotate JWT and administrative credentials, and investigate suspicious pbxapi requests, Asterisk activity, web-file changes, processes, and outbound connections.
MultiVendorX: REST API broken object-level authorization (CVE-2026-74926
MultiVendorX before version 5.0.16 does not verify that a user owns the store targeted by one REST API route. Any authenticated user, including a subscriber, can potentially overwrite another store’s settings, including ownership and other sensitive store details.
This is a straightforward BOLA/IDOR pattern: authentication exists, but authorization is not enforced against the specific object being modified.
Action: Upgrade to MultiVendorX 5.0.16 or later. Audit vendor/store ownership and payout-configuration changes, review REST API activity, and investigate low-privilege accounts that accessed vendor-management routes.
Cisco Secure FMC: March-patched flaw receives active-exploitation confirmation
Cisco originally disclosed CVE-2026-20079 on March 4. On September 9, Cisco updated its advisory to say it had become aware of active exploitation beginning in August. Cisco Talos reported attackers exploiting CVE-2026-20079, a CVSS 10 authentication bypass, together with CVE-2026-20316.
Reporting described three intrusion clusters and activity involving credential theft, malware deployment, and Qilin ransomware staging. This is a firewall-management-plane issue, so successful compromise can create privileged access to broader security infrastructure.
Action: Apply Cisco remediation and restrict FMC management access to tightly controlled administrative networks. Audit users, policies, device configurations, CLI/script activity, remote-access settings, and outbound connections. Rotate FMC admin/API credentials and connected identity/integration secrets.
JFrog Artifactory: older attack campaign receives KEV and exploitation updates
Wiz published a report on September 10 describing attacks observed from August 15 through September 8 against JFrog Artifactory. Attackers chained CVE-2026-42018 with CVE-2026-42016 to obtain administrator control; CVE-2026-82329 was also exploited independently.
CISA added CVE-2026-42016 and CVE-2026-42018 to KEV on September 11, while CVE-2026-82329 entered KEV on September 2. Artifactory compromise can expose packages, build artifacts, container images, deployment credentials, and tokens. The corrected CVSS for CVE-2026-42016 is 8.1.
Action: Upgrade to JFrog fixed releases. Review administrators, tokens, permission targets, repository/remote-repository configuration, package uploads, artifact checksums, build activity, and CI/CD behavior. Treat unpatched exposure during the campaign period as a possible supply-chain incident.
Citrix NetScaler: August disclosure remains urgent after September update
Citrix published CVE-2026-19490 on August 19. The alternate-path authentication-bypass issue remained a September priority after government/CISA alerts and exploitation reporting increased urgency for qualifying internet-facing Gateway and AAA configurations.
Exploitability depends on version and configuration; Citrix identifies Gateway/AAA virtual-server conditions and SAML-related prerequisites in certain version ranges. Do not assume every ADC deployment is vulnerable through this path, but assess and upgrade affected deployments promptly.
Action: Apply Citrix fixed builds, identify qualifying Gateway/AAA and SAML configurations, revoke sessions where appropriate, rotate administrative/service credentials, and forward gateway/authentication/audit logs to external monitoring.
ConnectWise ScreenConnect: client-side KEV escalation (CVE-2026-84869, CVSS 9.9
ConnectWise released ScreenConnect version 26.6.5 on September 8 to address CVE-2026-84869. The flaw affects the ScreenConnect client, not the server; in an active remote session, it can allow a low-privileged participant to transfer and execute files on the host without host confirmation under affected conditions.
CISA listed the CVE in KEV on September 11. The designation makes client-version verification and session-exposure review urgent for organizations using ScreenConnect, especially MSPs and support teams with broad customer access.
Action: Upgrade clients to 26.6.5 or later. Review transferred/executed files, operator/session roles, and endpoint activity; limit unattended or unnecessary remote-support access.
VMware vCenter: older RCE with ransomware reporting during the period (CVE-2026-59310, CVSS 9.8)
CVE-2026-59310 predates this reporting week. During September 9–16, reporting indicated ransomware actors were using the vCenter Syslog service RCE in ongoing attacks. The available evidence supports treating this as an exploitation update, not a new September disclosure or a vendor-confirmed new incident.
vCenter remains a high-value target because compromise can expose hypervisor management and accelerate disruption, lateral movement, or ransomware across virtualized environments.
Action: Apply Broadcom’s update, remove internet exposure to vCenter Syslog services, restrict management interfaces, review service/configuration changes and remote access, and validate backup/recovery readiness.
New Reporting on Earlier Campaigns
PaperCut: AI-assisted exploitation campaign reporting
New reporting published September 9–10 described a suspected Russian-speaking actor using AI-assisted workflows and hundreds of AI agents against PaperCut NG/MF vulnerabilities. The campaign itself began August 31 and reportedly compromised more than 440 instances.
This is not a new PaperCut vulnerability for the period. It is new reporting on the speed and scale with which AI-assisted workflows can support reconnaissance and exploitation.
Action: Ensure PaperCut emergency fixes are applied, remove unnecessary internet exposure, and hunt for remote-access tools, unexpected Java child processes, persistence, altered configuration, and suspicious outbound traffic.
AI session tokens and API keys in infostealer data
Research published September 9 analyzed an infostealer dataset released earlier and reported replayable AI session tokens and still-valid API keys for AI services. The research date is in scope, but the underlying data exposure predates the week.
AI-provider tokens are production credentials: theft can enable unauthorized model access, unexpected billing, prompt/data exposure, and abuse of connected enterprise workflows.
Action: Rotate exposed AI-provider tokens, apply least privilege and spending limits, prohibit secrets in browser-accessible storage, centralize usage monitoring, and investigate unusual model/API activity.
Marimo: older incident revisited in September reporting
Reporting published September 15 revisited CVE-2026-39987, an unauthenticated terminal-WebSocket RCE in Marimo. The flaw was disclosed and patched in April 2026, and associated CISA KEV activity also occurred in April; it is not a newly disclosed or newly active September incident.
The September coverage remains useful as a case study of how an exposed notebook endpoint can provide an interactive shell and pivot toward cloud secrets and internal infrastructure.
Action: Confirm Marimo is upgraded to 0.23.0 or later, remove unnecessary public access, apply least privilege to cloud secrets, and monitor shell, cloud API, secret-read, and SSH activity from notebook environments.
What to Do This Week
- Patch first: Cisco ISE, WSO2 API Manager, Issabel Framework, MultiVendorX, GitLab, Cisco Secure Email Gateway, ConnectWise ScreenConnect clients, Cisco FMC, JFrog Artifactory, Citrix NetScaler, and VMware vCenter. Prioritize by active exploitation, KEV status, public exposure, and management-plane privilege.
- Treat identity and API control planes as crown jewels. Restrict Cisco ISE, WSO2, FMC, NetScaler, Artifactory, GitLab, and remote-support administration to controlled networks, VPN, or zero-trust access—not direct public exposure.
- Hunt for post-exploitation: unknown users/administrators, forged or unusual JWTs, API tokens, changed permission targets, policy/configuration changes, altered repository/artifact settings, CI/CD changes, rogue packages, web shells, abnormal remote sessions, and unusual outbound traffic.
- Rotate potentially exposed credentials: GitLab tokens and CI/CD variables; Artifactory tokens and deployment credentials; appliance admin/API credentials; JWT-signing material; SAML/identity-integration secrets; PBX administrative credentials; service accounts; and AI-provider tokens.
- Apply virtual patching and behavior monitoring for traversal, SQL injection, authentication bypass, token abuse, malicious file upload/write activity, request anomalies, exploit scanning, suspicious API calls, and automated abuse while remediation proceeds.
- Protect API authorization: test object-level authorization in customer, vendor, payout, administrator, and workflow APIs; enforce deny-by-default access checks and monitor anomalous low-privilege API activity.
How Unified WAAP Protection Helps
The week’s developments emphasize application and API control planes: repository APIs, identity-management APIs, API-manager consoles, firewall-management interfaces, artifact platforms, email-processing appliances, PBX web frameworks, remote-support clients, and cloud-connected developer services. A unified WAAP approach can reduce the time between exposure discovery, exploit detection, virtual mitigation, and patch deployment.
- Virtual patching for path traversal, SQL injection, authentication bypass, JWT abuse, upload/write abuse, request smuggling, and anomalous API behavior.
- Continuous API discovery and governance to find exposed administrative routes, developer-platform APIs, unauthenticated WebSockets, undocumented REST endpoints, and credential-bearing integrations.
- Behavioral bot and abuse detection for exploit scanning, token misuse, repository scraping, automated credential attacks, BOLA/IDOR abuse, and abnormal administrative actions.
- Integrated L3/L4/L7 DDoS mitigation and centralized telemetry to preserve availability and connect edge events with application, API, identity, endpoint, and origin activity.
Frequently Asked Questions (FAQ)
1. What is genuinely new in the September 9–16 report?
GitLab CVE-2026-85706 was disclosed/patched September 10, Cisco Secure Email Gateway CVE-2026-76461 was disclosed September 14 with confirmed exploitation, and the September 16 update includes Cisco ISE API/REST advisories, WSO2 API Manager exploitation reporting, Issabel exploitation reporting, and MultiVendorX REST API authorization disclosure.
2. Why are Cisco FMC, JFrog, Citrix, VMware, PaperCut, and Marimo included if they are older?
They received material exploitation reporting, KEV action, alerting, or new analysis during the reporting period. The report labels them as updates or new reporting instead of presenting them as newly disclosed vulnerabilities.
3. Why is WSO2 API Manager especially relevant to API security?
An API-management control plane governs API definitions, policies, authentication flows, developer access, gateway behavior, and backend integrations. Forged administrator JWTs can therefore create a high-privilege route to connected APIs and services.
4. What is a BOLA vulnerability?
Broken Object-Level Authorization occurs when an application authenticates a user but fails to verify that the user is authorized to access or change the specific record, account, store, order, or resource named in a request.
5. What is virtual patching?
Virtual patching uses WAF/WAAP enforcement to detect or block exploit behavior while vendor patches are evaluated and deployed. It reduces exposure but does not replace remediation, credential rotation, or forensic review.
6. How should teams prioritize this list?
Start with internet-facing, known-exploited, and highly privileged assets: Cisco ISE, WSO2 API Manager, Issabel PBX APIs, GitLab, Cisco Secure Email Gateway, Cisco FMC, Artifactory, NetScaler Gateway/AAA, ScreenConnect clients, and vCenter. Then factor in business criticality, access to secrets, customer impact, and CI/CD or production connectivity.
