This brief covers the trailing ~48 hours (September 17–19, 2026). Every item below was traced to a primary source — CISA’s KEV catalog, a vendor release or advisory, or the original researcher’s write-up — and the disclosure date was confirmed on that page.
CISA adds three actively exploited Linux kernel flaws to KEV, federal deadline Sept. 21
CISA · September 18, 2026
In two separate alerts on September 18, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-39682 (improper check in the kernel TLS receive path, where a zero-length record from rx_list bypasses recvmsg() record-type handling), CVE-2026-53266 (out-of-bounds write in the ebtables SNAT target’s ARP hardware-address rewrite), and CVE-2025-39964 (race condition on concurrent writes to the same AF_ALG socket). Published CVSS scores are 9.8, 8.8, and 7.8 respectively. All three carry a KEV due date of September 21, 2026, and CISA marks each as requiring forensic triage under BOD 26-04; ransomware use is listed as “Unknown.” Red Hat updated its advisories for all three to acknowledge active exploitation, and fixes are available in current stable kernels.
“CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-39964 Linux Kernel Race Condition Vulnerability. CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability.” — CISA alert, September 18, 2026
Source: CISA alert (two KEVs) · CISA alert (one KEV) · KEV catalog entry · The Hacker News
Public root exploits released for four Linux kernel LPEs: DirtyAH6, TUNderflow, PPPoEject, DiagSpill
Asim Manizada (researcher write-up) · September 18, 2026
Researcher Asim Manizada published a coordinated write-up and working proof-of-concept exploits for four Linux kernel local privilege escalation bugs, all found with an AI-assisted hunting harness: CVE-2026-80844 (DirtyAH6, IPv6 IPsec AH routing-header OOB), CVE-2026-81000 (TUNderflow, TUN/TAP headroom integer underflow), CVE-2026-68121 (PPPoEject, PPPoE use-after-free), and CVE-2026-74469 (DiagSpill, SCTP sctp_diag 16-bit transport counter wrap spilling ~8 MiB). The bugs were reported to the kernel security team in mid-July; patches landed upstream and the first stable releases containing all four fixes are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Three require unprivileged user namespaces; DiagSpill needs no special privileges when SCTP is available. No CVSS scores are listed in the write-up, and no in-the-wild exploitation has been reported. Not in KEV.
“Four more Linux LPEs; two of the corruption bugs are reachable remotely under very specific circumstances, with one theoretically remote-groomable to remote root.” — Asim Manizada, lpe-quartet write-up
Source: Researcher write-up (heyitsas.im) · The Hacker News
WordPress 7.1.1 ships 11 security fixes, including the “Click2Shell” forced theme-install flaw
WordPress.org · September 17, 2026
WordPress 7.1.1 is a short-cycle security and maintenance release with 17 core bug fixes, 19 Block Editor fixes, and 11 security fixes. The headline items are an unauthenticated stored cross-site scripting bug in wpautop() (subject to comment approval) and a flaw where specially crafted URLs can automatically install and preview an inactive theme from WordPress.org when opened by a logged-in administrator — reported by Paulos Yibelo and pwn.ai, who describe a chain they call Click2Shell. Other fixes include an authenticated path traversal in the REST Templates Controller and a Contributor+ arbitrary post overwrite (both reported by Anthropic), an XML-RPC edit_css bypass, and several authorization and disclosure issues. The release post does not list CVE IDs or CVSS scores. Backports to older branches are in progress. Not in KEV.
“Because this is a security release, it is recommended that you update your sites immediately.” — WordPress 7.1.1 release announcement
Source: WordPress.org release post · The Hacker News
vm2 sandbox-escape wave: more than a dozen CVEs, several at CVSS 10, fixed in 3.11.7
VulnCheck (CNA) / CVE.org · September 17, 2026
A batch of CVE records published September 17 covers a wave of sandbox escapes in the widely used vm2 Node.js library. CVE-2026-92941 (CVSS 10.0, CWE-732) allows NodeVM sandbox code to reach the host tls module and call tls.setDefaultCACertificates(), replacing the process-wide certificate trust store; it affects vm2 3.11.3 through 3.11.6 and is fixed in 3.11.7. Related records in the same batch (including CVE-2026-92937, CVE-2026-92940, CVE-2026-92946, CVE-2026-92953, CVE-2026-92955, CVE-2026-92956, and CVE-2026-92960, each scored 10.0, plus several at 9.9) describe escapes via Promise rejection handling, https.globalAgent, require.external, TypedArray/ArrayBuffer prototypes, WebAssembly compilation streams, and the os/dns builtins. Any service running untrusted JavaScript in-process with vm2 — including many AI-agent tool runners — should upgrade to 3.11.7 or later. No exploitation in the wild has been reported; not in KEV.
“vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities.” — CVE-2026-92941 record (VulnCheck)
Source: CVE.org record · vm2 GitHub advisory · Vulners
Plugin4Shell: SHA-pinning bypass in four AI coding agents; Claude Code and Codex patched, Copilot and Gemini CLI unfixed
Air Security · September 17, 2026
Air Security disclosed a plugin supply-chain flaw affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Each agent checks out a marketplace-pinned commit but never verifies that the resulting working tree matches the pin; an attacker controlling a plugin’s repository can create a default branch named with the 40-hex pinned SHA (or, for Gemini CLI, a branch named FETCH_HEAD) so that git checkout resolves the ref instead of the commit. Combined with background auto-update, the swap requires no user interaction. Per Air’s timeline, the flaw was found in May, disclosed to all four vendors in June, fixed in Claude Code 2.1.179 and Codex 0.146.0, while Copilot has no fix and Google will not patch the deprecated Gemini CLI. GitHub rejects hash-shaped branch names, so the branch variant applies to plugins hosted on Bitbucket or self-hosted git. No CVE has been assigned, no CVSS is published, and Air reports no evidence of in-the-wild exploitation. Not in KEV.
“It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin’s repo makes the checkout resolve to malicious code while the pin still looks honored.” — Air Security, Plugin4Shell disclosure
Source: Air Security disclosure · The Hacker News
Microsoft Fabric authentication bypass rated CVSS 10.0 (CVE-2026-69843)
Microsoft MSRC · September 17, 2026
Microsoft published CVE-2026-69843, an authentication bypass by spoofing in Microsoft Fabric that allows an unauthorized attacker to elevate privileges over a network, rated CVSS 10.0 and classified as CWE-287. As a cloud-service vulnerability it was mitigated on Microsoft’s side and carries no customer patch. It was published alongside a cluster of other Microsoft cloud-service CVEs the same day. Microsoft has not reported exploitation; not in KEV.
“Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.” — MSRC Security Update Guide, CVE-2026-69843
Source: MSRC CVE-2026-69843 · CVE Brief daily roundup
Brevo post-mortem: stolen Cloudflare API key used to inject ClickFix into customer-embedded scripts
Brevo (status.brevo.com) / BleepingComputer · September 17, 2026
Brevo published a post-mortem confirming that attackers obtained a long-lived, full-permission Cloudflare API key that had been hardcoded in application source code and used it to create a malicious Cloudflare Worker. For roughly five and a half hours on September 14 (16:07–20:30 UTC), the Worker rewrote responses at the CDN edge for brevo.com, sendinblue.com, and sibforms.com, and modified the Brevo forms, Conversations widget, and SDK loader scripts that customers embed on their own sites — Sansec estimates up to 100,000 sites were affected. Visitors were shown a fake Cloudflare verification page with ClickFix instructions; on WordPress sites the script also tried to upload a backdoor plugin (“Web Media Optimizer”) if the visitor was a logged-in admin. Brevo revoked the key, removed the Worker, and says its app, API, and customer data were not affected. No CVE applies.
“Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change.” — Brevo post-mortem, as quoted by BleepingComputer
Source: Brevo post-mortem · BleepingComputer · SecurityWeek
Still developing
Cisco ISE zero-day authentication bypass (CVE-2026-76460, CVSS 10.0) exploited in the wild
Cisco PSIRT · September 16, 2026
Cisco published an advisory for CVE-2026-76460, a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), exploitable regardless of configuration. Cisco PSIRT confirmed active exploitation, and successful attacks can lead to command execution as root. There are no workarounds; fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. CISA added the CVE to KEV on September 16 with a three-day federal deadline. Cisco recommends checking access.log on every node for suspicious usernames and re-imaging nodes where compromise is suspected.
“The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” — Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5
Source: Cisco advisory · CISA KEV alert · BleepingComputer
This brief covers the trailing ~48 hours (September 17–19, 2026).
Primary sources:
- CISA — Adds Two Known Exploited Vulnerabilities to Catalog (Sept. 18)
- CISA — Adds One Known Exploited Vulnerability to Catalog (Sept. 18)
- CISA — Known Exploited Vulnerabilities Catalog
- Asim Manizada — A quartet of Linux local root vulns
- WordPress — 7.1.1 Maintenance and Security Release
- CVE.org — CVE-2026-92941
- Air Security — Plugin4Shell
- Microsoft MSRC — CVE-2026-69843
- Brevo — Incident post-mortem
- Cisco — cisco-sa-ISE-ABP-VNSW7Tn5