Vulnerability Management Analyst: 2026-09-19
15 minutes in total
SolarWinds, 2026-09-17. Read, 1 min.
SolarWinds published an advisory for CVE-2026-28326, an unauthenticated remote code execution vulnerability in Access Rights Manager rated CVSS 8.8 that stems from a hardcoded static key. Access Rights Manager 2026.2 and all previous versions are affected, the fix is 2026.2.1, and the advisory makes no statement either way about exploitation.
Why it matters for this role: Query the inventory for Access Rights Manager instances, confirm whether any run 2026.2 or earlier, and schedule the move to 2026.2.1. The advisory does not say whether the flaw has been exploited, so set the priority from how exposed your own instances are rather than from that silence.
Corrected 2026-09-21: An earlier version said there was no evidence of exploitation and placed the fix in the normal patch cycle. The SolarWinds advisory makes no statement about exploitation either way. The item now cites the advisory itself instead of a news report about it.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA (Cybersecurity and Infrastructure Security Agency), 2026-09-18. Read, 1 min.
CISA added CVE-2025-39682, described as a Linux kernel improper check for unusual or exceptional conditions, to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation. The alert points federal civilian agencies to BOD 26-04, which requires them to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, while deferring action on lower-risk vulnerabilities. CISA encourages all organizations, not only federal agencies, to adopt risk-based vulnerability management and prioritize KEV remediation.
Why it matters for this role: Move CVE-2025-39682 ahead of routine distro patching in this week's queue and report which Linux hosts still carry the vulnerable kernel. The KEV listing is also the cue to ask whether any affected host needs a compromise check before the patch closes the window.
Corrected 2026-09-21: An earlier version said BOD 26-04 directs agencies to prioritize rapid remediation of KEV-listed CVEs in general. The alert limits that to KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, with action on lower-risk vulnerabilities deferred. The key sentence and the question now carry that limit.
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco (PSIRT), 2026-09-16. Read, 7 min.
Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on 2026-09-16 for CVE-2026-76460, a CVSS 10.0 authentication bypass caused by insufficient authentication control on an ISE API endpoint, affecting Identity Services Engine and the ISE Passive Identity Connector regardless of device configuration. Cisco says an unauthenticated attacker sending a crafted request may obtain command execution with root privileges, that PSIRT is aware of active exploitation, and that there are no workarounds that address the vulnerability, with infrastructure access control lists restricting management traffic offered as mitigation only. First fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.
Why it matters for this role: Identify every ISE and ISE-PIC node, map each one to its fixed patch level from 3.1 Patch 12 through 3.5 Patch 4, and push the change as an out-of-band item. There is no workaround, so management access control lists are only a note in the ticket, not a deferral reason.
Cisco (PSIRT), 2026-09-16. Read, 6 min.
Cisco published a hardening release covering eight vulnerabilities, CVE-2026-20329 through CVE-2026-20336, in Secure Firewall ASA, FTD and FMC software, found through internal security testing that Cisco says used its existing processes together with frontier AI models. For the vulnerabilities described in this advisory, Cisco states that PSIRT is not aware of any public announcements or malicious use. The advisory separately points readers to two other Firewall Management Center issues, a static credential vulnerability and an authentication bypass, each with its own advisory, which Cisco says are known to be actively exploited. There are no workarounds; Cisco directs customers to the fixed releases listed per branch.
Why it matters for this role: Pull current ASA, FTD and FMC versions across the firewall estate and build the per-branch upgrade plan for the eight CVEs. Rank it below the two separately advised FMC issues, the static credential flaw and the authentication bypass, which Cisco says are actively exploited.
The quiz for this edition has closed.