Cybersecurity Specialist: 2026-09-30
12 minutes in total
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
Cisco, 2026-09-30. Read, 7 min.
Cisco disclosed CVE-2026-76504 (CVSS 9.8), a flaw in the API authentication of Cisco Catalyst SD-WAN Manager that could let an unauthenticated, remote attacker access an affected system with the privileges of the admin user, and says its PSIRT became aware of active exploitation in September 2026. Fixed releases include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, and the Cisco-managed cloud release 20.15.605 needs no customer action.
Why it matters for this role: Find out first whether your SD-WAN Manager is on-premises or Cisco-managed, because only on-premises deployments need an upgrade from you.
About the security content of iOS 26.7.1 and iPadOS 26.7.1
Apple, 2026-09-28. Read, 2 min.
Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics through which processing a maliciously crafted file may lead to arbitrary code execution. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
Why it matters for this role: Push iOS 26.7.1 and iPadOS 26.7.1 to every managed iPhone and iPad not yet on iOS 27, because those older versions are where Apple places the possible exploitation.
Kiteworks Restores Systems After Credible Threat
Kiteworks, 2026-09-28. Read, 3 min.
Kiteworks says all customer systems may be restored to normal operations after the precautionary shutdown it recommended on September 25 in response to credible threat intelligence from federal intelligence authorities. During the shutdown it discovered and fixed a previously unknown critical vulnerability confined to a capability enabled for less than 1% of its customer base, and it says it has no indication the vulnerability was ever exploited.
Why it matters for this role: Restart any Kiteworks system you took offline on the vendor's September 25 advice, which Kiteworks now says can come back online.
Sign in to take it.