Weekly Security Watch
This week was dominated by exploitation of trusted control points: source-code platforms, virtualization management, identity enforcement, email security, remote support, repositories, routers and mobile devices. Exposed management interfaces, delayed emergency patching, excessive trust in security tooling, and insufficient compromise assessment after patching drive this trend.
Important Developments
GitLab CVSS 10 flaw is actively exploited
The Dutch NCSC warned that CVE-2026-85706 affects self-managed GitLab Community and Enterprise editions and is being actively exploited. Unauthenticated requests can expose server files; public exploit code lowers the barrier to abuse. According to the alert, GitLab.com and GitLab Dedicated are not affected.
GitLab often holds source code, deployment secrets and links to production pipelines, making compromise a supply-chain and credential risk.
Impact: Loss of source code, tokens or credentials could enable lateral movement and malicious software releases. For entities that fall under NIS2, compromise may trigger incident assessment and reporting duties, depending on impact. The software sector might obviously be affected, but diverse technology industries and financial services as well. Any organization operating self-managed GitLab accounts should take action.
Recommended actions: Upgrade to 19.1.8, 19.2.6, 19.3.2 or later supported versions; review logs on internet-facing instances; rotate potentially exposed credentials and deployment keys.
Sources:
https://www.ncsc.nl/alerts/kritieke-kwetsbaarheid-in-gitlab-wordt-actief-misbruikt-update-nu
VMware vCenter exploitation expands to ransomware
CISA updated its assessment of CVE-2026-59310 to indicate use in ransomware campaigns. The unauthenticated vCenter Syslog flaw can permit remote code execution; reporting also indicates hundreds of compromised IP addresses across dozens of countries.
vCenter is a control plane for virtual infrastructure. Its compromise can give attackers a rapid route to business-critical workloads and backups.
Impact: Potential encryption or shutdown of multiple virtual machines, broad service disruption and prolonged recovery. Material outages or data compromise may activate NIS2, DORA and privacy notification processes. Sectors such as healthcare, manufacturing and critical infrastructure could be affected.
Recommended actions: Treat unpatched or exposed vCenter as an incident; patch immediately; restrict management access; hunt for persistence and unexpected outbound tunnels; verify offline recovery.
Sources:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/
Cisco secure email gateway flaw gives remote root access
CISA added CVE-2026-76461 to KEV after confirmed exploitation. The SQL injection flaw in Cisco AsyncOS for Secure Email Gateway can allow an unauthenticated remote attacker to execute commands with root privileges.
Email gateways process untrusted internet traffic and sit in a trusted security position, making them valuable for persistence, interception and credential theft.
Impact: Full appliance compromise, possible mail interception and a pivot into internal systems. Organizations using physical, virtual or managed Cisco email gateways are potentially affected.
Recommended actions: Apply Cisco fixes without delay; review gateway and perimeter logs; preserve evidence outside the appliance; rotate secrets accessible from the gateway if compromise is suspected.
Sources:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Cisco ISE and Acronis Backup added to KEV
CISA added actively exploited CVE-2026-76460 in Cisco Identity Services Engine and CVE-2026-87886 in Acronis Backup for hosting platforms to the KEV. Cisco ISE is particularly sensitive because it governs network access and identity-based policy.
Compromise of access-control or backup platforms undermines two core resilience layers: who may connect and whether systems can be recovered.
Impact: Unauthorized access, policy manipulation, backup exposure and wider lateral movement. Large enterprises, managed hosting, service providers and organizations relying on network admission control might be affected.
Recommended actions: Patch affected versions; limit management interfaces; review privileged API activity; validate backup integrity and separation; conduct forensic triage where exposure existed.
ScreenConnect flaw creates downstream managed-service risk
After exploitation of this vulnerability was observed, CISA added CVE-2026-84869, rated 9.9, to the KEV. The authorization weakness can allow file transfer and execution through an active remote session without host confirmation.
Remote-management tools provide direct access to customer environments. A single compromised service-provider instance can amplify impact across many organizations.
Impact: Malware deployment, ransomware staging and multi-customer compromise. Affected providers may face contractual, NIS2 supply-chain and incident-notification obligations.
Recommended actions: Install the 8 September patch; restrict exposure; disable unnecessary file-transfer rights; review active sessions, transferred files and provider access logs.
Sources:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.msspalert.com/news/connectwise-screenconnect-bug-exploited-in-the-wild-cisa-says
Artifactory and RouterOS exploitation targets software and network trust
CISA added exploited flaws affecting JFrog Artifactory and MikroTik RouterOS. Attackers have reportedly chained Artifactory weaknesses to gain administrative control and deploy backdoors; RouterOS flaws can expose kernel memory or enable privilege escalation.
These products occupy trusted positions in software delivery and network routing. Compromise can contaminate builds or provide durable network access.
Impact: Backdoored artifacts, stolen tokens, traffic visibility and disruption of network services. Software development, telecoms, service providers and organizations using self-hosted artifact repositories are potential victims.
Recommended actions: Patch all affected products; rotate repository tokens; inspect artifacts and administrative changes; restrict RouterOS management and unnecessary services.
Sources:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html
New mobile exploitation adds executive device risk
CISA added Google Pixel CVE-2026-58704 to KEV. The modem authorization flaw may allow permission checks to be bypassed and privileges escalated; exploitation is described as limited.
Targeted mobile exploitation can put executive communications, credentials and authentication flows at risk.
Impact: Device compromise and exposure of sensitive corporate communications or account access. Executives, government, defence, regulated sectors and organizations with bring-your-own-device programs are at risk.
Recommended actions: Confirm security update status through mobile-device management; prioritize high-risk users; review device eligibility and replacement policies for unsupported hardware.
Sources:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Takeaways
Common patterns
The week is dominated by exploitation of trusted control points: source-code platforms, virtualization management, identity enforcement, email security, remote support, repositories, routers and mobile devices. The recurring weaknesses are exposed management interfaces, delayed emergency patching, excessive trust in security tooling and insufficient compromise assessment after patching.
Ransomware operators continue to convert infrastructure vulnerabilities into resilience events rather than isolated server incidents.
Sector insights
Technology and software teams face the clearest supply-chain risk through GitLab and Artifactory. Managed service providers might carry concentration risk through ScreenConnect. Regulated and critical sectors should prioritize VMware, Cisco ISE and email gateways because compromise can simultaneously affect access, communications and recovery.
Regulatory implications
NIS2 and the Dutch Cybersecurity Act raise expectations for governance, supply-chain controls, vulnerability handling and timely incident reporting. DORA-regulated financial entities should connect the VMware, remote-access and service-provider developments to ICT continuity, third-party oversight and major-incident classification.
Strategic recommendations
CISOs should establish a 24-to-72-hour emergency path for exploited management-plane flaws. Security leaders should pair patching with forensic triage, credential rotation and external-exposure verification. Risk leaders should map remote-management and platform vendors to critical services and concentration scenarios. Privacy officers should pre-agree thresholds for assessing whether stolen repositories, mail systems or mobile devices contain personal data. Boards should request evidence that recovery platforms and administrative identities cannot be disabled through the same control plane they protect.
Board-level narrative
This week shows that operational resilience can fail through a small number of highly trusted systems. It's not relevant whether every vulnerability is patched, but whether the organization can identify and remediate exploited weaknesses in critical control planes before attackers convert access into a widespread outage. Business continuity depends on segregated management access, trustworthy backups and tested recovery.
Governance should require accountable ownership of internet-facing platforms and service-provider access. Regulatory exposure increases when known exploitation is not matched with rapid remediation, compromise assessment and documented reporting decisions.
This overview was generated with AI assistance and has been verified and edited by a human editor. If you have spotted a factual error, please let us know in the comments.
The information contained in this security watch is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. CISO Community and CISO Platform Nederland assume no legal liability or responsibility for any damage resulting from either the use or inability to use the information included. This includes damage resulting from the inaccuracy or incompleteness of the information contained in the briefing.
