Security Advisory

This Week's Top 5 Security Developments: Cisco's Maximum-Severity ISE Bypass and a Critical Email Gateway Flaw

Published September 20, 2026 · Cyber One Solutions

Cisco disclosed a maximum-severity authentication bypass in Identity Services Engine and a critical SQL injection in Secure Email Gateway, both under confirmed active exploitation in the same week, while CISA added a year-old Linux kernel flaw and a backup-software privilege escalation to its Known Exploited Vulnerabilities catalog. Here are the top five verified developments for small and mid-size businesses, ranked by severity, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, September 13 through Saturday, September 19, 2026, with a research cutoff of Sunday, September 20, 2026 at 6:00 a.m. Central. It was a week defined by a maximum-severity Cisco authentication bypass and a critical Cisco email-gateway injection flaw, both under confirmed active exploitation in the same seven-day span, a year-old public proof-of-concept finally reaching CISA's exploited-vulnerabilities catalog, and a backup-software flaw that shows why the software protecting your recovery plan needs the same scrutiny as everything else on your network.

Executive Summary and Priorities

Five verified developments met our bar for inclusion this week, ranked by severity, independently confirmed evidence of exploitation, business impact, and urgency:

Cisco Identity Services Engine: a maximum-severity, CVSS 10.0 authentication bypass under confirmed active exploitation, with no workaround, undermining ISE's ability to reliably tell a legitimate device from an attacker once bypassed.
Cisco Secure Email Gateway: a CVSS 9.8 SQL injection under confirmed active exploitation, reachable with nothing more than a single crafted email.
A Linux kernel flaw in the kTLS receive path: publicly known for a year before CISA confirmed active exploitation, a reminder that "no one has weaponized it yet" is not the same as "it is not exploitable."
A privilege-escalation flaw in the Acronis Backup plugin for cPanel and WHM: confirmed exploited in targeted attacks, turning backup software, the tool meant to get you out of an incident, into a foothold for one instead.
Microsoft's September 30, 2026 Entra Connect Sync cutoff: not an attack, but a hard deadline now ten days away that silently breaks identity synchronization for any unpatched hybrid Microsoft 365 environment.

How We Ranked This Week's Developments

We ranked these five by CVSS severity, independently confirmed evidence of exploitation (a vendor's own confirmation, a CISA Known Exploited Vulnerabilities catalog listing, or both), how directly the affected system sits in the path of an attacker gaining broad access, and how much time remains before a deadline or consequence lands. Two items this week, the Entra Connect Sync cutoff and the Linux kernel flaw, are not conventional "patch this exploit" stories: one is a guaranteed operational failure with a fixed date, and the other requires an attacker to already have a foothold. We ranked both on business impact and urgency rather than on exploitability alone, and we say so explicitly in each section below.

1A Maximum-Severity Cisco ISE Bypass Leaves No Way to Trust Your Network Access Control

Cisco disclosed CVE-2026-76460, an authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), on September 16, 2026, in advisory cisco-sa-ISE-ABP-VNSW7Tn5, carrying a maximum CVSS v3.1 base score of 10.0. Cisco's Product Security Incident Response Team stated plainly that it "is aware of active exploitation of this vulnerability," and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day with a September 19, 2026 remediation deadline for federal civilian agencies, a date that has already passed as of this brief's publication, according to Cisco's security advisory and CISA's Known Exploited Vulnerabilities catalog.

Cisco ISE is the system many mid-size networks rely on to decide which users and devices are allowed on the network at all, and Cisco's advisory says the flaw affects ISE and ISE-PIC versions 3.1 through 3.5 "regardless of device configuration," meaning every deployment mode is exposed. Cisco has released fixes (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4) and confirmed there is no workaround, so patching is the only real fix; version 3.0 is no longer supported and needs to be upgraded to a patched branch first. We covered the full technical and HIPAA access-control detail in our News & Advisories coverage when Cisco confirmed exploitation. If your ISE deployment has been reachable from outside your trusted network at any point since before September 16, treat this as a possible compromise, not only a missing patch, and review authentication and admin logs for anything unfamiliar.

2A Cisco Email Gateway Flaw Is Under Confirmed Active Exploitation

Cisco published advisory cisco-sa-esa-inj-2bLVGmhX on September 14, 2026, disclosing CVE-2026-76461, a critical SQL injection vulnerability in Secure Email Gateway carrying a CVSS v3.1 base score of 9.8. Cisco's Product Security Incident Response Team said it "became aware of active exploitation of this vulnerability," and CISA added the flaw to its KEV catalog the same day it was disclosed, with a September 17, 2026 remediation deadline, per Cisco's security advisory and CISA's Known Exploited Vulnerabilities catalog.

The flaw sits in the appliance's email parsing logic: a single crafted email containing malicious SQL statements can lead to arbitrary SQL execution and, from there, command execution with root privileges on the underlying operating system, with no authentication, no user interaction, and no reply required from anyone inside the organization. Vulnerable AsyncOS releases are 15.5 and earlier, 16.0, and 16.5; fixed releases are 15.5.5-014, 16.0.4-302, and 16.5.0-780, and Cisco "strongly recommends" migrating to 16.5.0-780 regardless of which fixed build you land on. We covered the full detail in our News & Advisories coverage when this was first confirmed. If your organization runs Secure Email Gateway and did not patch before September 14, treat inbound mail logs from that period as a possible compromise window, not just a missed update.

3A Year-Old Linux Kernel Flaw Finally Shows Up in CISA's Catalog

CISA added CVE-2025-39682, an improper-condition-check vulnerability in the Linux kernel's TLS receive path (net/tls/tls_sw.c), to its KEV catalog on September 18, 2026, with a September 21, 2026 remediation deadline for federal civilian agencies, one day out as of this brief's publication. The flaw carries a CVSS v3.1 base score of 7.1, reflecting a local attack vector with low complexity and low privileges required, and a public proof-of-concept has reportedly circulated since September 2025, a full year before CISA confirmed active exploitation, according to CISA's Known Exploited Vulnerabilities catalog and reporting from The Hacker News.

This is a "second stage" flaw, not an internet-facing entry point: it requires an attacker to already have low-privilege, authenticated access to a Linux system using kernel TLS (kTLS) offload on the receive side, then trigger a use-after-free condition through a mishandled zero-length TLS record that can corrupt memory, crash the system, or be leveraged toward a fuller compromise. That makes it most relevant to shared or multi-tenant Linux servers, where more than one account or process already has local access, such as web hosting environments, application servers with multiple service accounts, or any Linux box an attacker could plausibly reach through a separate initial compromise. Upstream reports the flaw as present in mainline kernel 6.0 through 6.16.3, plus release candidates 6.17-rc1 and 6.17-rc2, but that is not a single continuous vulnerable range for every deployment: maintained stable and long-term-support branches (6.1, 6.6, 6.12, and others) receive backported fixes on their own schedule rather than following mainline version numbers, so a lower-numbered LTS kernel is not automatically unpatched. Red Hat, for example, has shipped fixes for Red Hat Enterprise Linux 9 and 10 under advisories RHSA-2025:16880 and RHSA-2025:16904. If your business or IT provider runs Linux servers, especially ones serving multiple tenants or applications, do not judge patch status from the mainline range alone; confirm your specific distribution's advisory and installed package version, and ask specifically whether kTLS offload is in use, since that is the feature this flaw depends on.

4A Backup Plugin Flaw Turns Your Recovery Tool Into an Attacker's Foothold

CISA added CVE-2026-87886, the "Acronis Backup Incorrect Default Permissions Vulnerability," to its KEV catalog on September 16, 2026, with a September 19, 2026 remediation deadline for federal civilian agencies. The flaw, tracked under CWE-276 for incorrect default file permissions, carries a CVSS v3.0 base score of 7.8 and affects the Acronis Backup plugin for cPanel & WHM on Linux before build 1.9.3.1021 (fixed in 1.9.3 HF3) and the Acronis Backup extension for Plesk on Linux before build 1.8.11.638 (fixed in 1.8.11), per Acronis advisory SEC-10986 and CISA's Known Exploited Vulnerabilities catalog.

An attacker needs a foothold already, such as a compromised cPanel account, stolen credentials, or a vulnerable web application on the same server, to exploit the file-permissions flaw and escalate from that limited access to substantially greater control of the host. Acronis has confirmed exploitation "in limited, targeted attacks" specifically against cPanel & WHM deployments, and states it has not observed exploitation against Plesk environments as of this week, per BleepingComputer's reporting on Acronis's advisory. The business risk here is not abstract: backup software runs with elevated privileges by design, so a flaw that lets a lower-privileged attacker ride it to root undermines the one system a ransomware response plan depends on. If your business or IT provider uses the Acronis Backup plugin for cPanel & WHM or the Plesk extension on a hosting or web server, confirm the build number against the fixed versions above today, and review the server for accounts or scheduled tasks you cannot account for if it was on a vulnerable build.

5Microsoft's Entra Connect Sync Cutoff Is Now Ten Days Away

Microsoft's hard deadline for Entra Connect Sync, the on-premises tool that keeps a local Active Directory synchronized with Microsoft 365 and Entra ID, is September 30, 2026, now ten days out as of this brief's publication. Microsoft's own documentation states that "all synchronization services in Microsoft Entra Connect Sync will stop working on September 30, 2026" for any server not running at least version 2.5.79.0, and that this is a hard failure, not a soft support cutoff, per Microsoft's upgrade documentation. This is not a new exploit, but it earns a spot this week because the consequence is not theoretical or probabilistic: every affected server will simply stop syncing account changes on that date, and the exposure window it creates depends on how your tenant authenticates: with Password Hash Synchronization, the most common setup, a terminated employee's cloud access can keep working until someone notices the sync is broken and disables the Microsoft 365 account by hand, while with Pass-through Authentication or federation, a fresh sign-in is blocked right away but any session or token issued before the account was disabled can still persist. Either way, that gap is exactly what a risk assessment is built to catch.

We covered who is affected, how to check your version, and why a stalled sync server is riskier than it sounds in our News & Advisories coverage when Microsoft's deadline first published. If your organization or IT provider has not confirmed the installed version against 2.5.79.0 and completed the upgrade, this is the week to do it, not the week of September 30.

Do Now

Confirm Cisco ISE and ISE-PIC are patched to the fixed release for your branch, and if not patched before September 16, review authentication and admin activity logs for anything unfamiliar.
Confirm Cisco Secure Email Gateway is on AsyncOS 16.5.0-780 (or another fixed build), and if not patched before September 14, review inbound mail logs from that window for signs of compromise.
Check the kernel version on every Linux server your business or IT provider runs, particularly any using kTLS offload or serving multiple tenants or applications, against the fixed builds for your distribution ahead of the September 21 deadline.
Confirm the Acronis Backup plugin for cPanel & WHM (build 1.9.3 HF3 or later) or the Plesk extension (build 1.8.11 or later) is current on any hosting or web server that runs it.
Verify your Entra Connect Sync server is on version 2.5.79.0 or later before September 30.

Plan Next

Ask your IT provider or MSP for a written, dated confirmation of which of this week's five items applied to your environment and when each was remediated.
Given a maximum-severity Cisco bypass and a critical Cisco injection flaw, both confirmed exploited in the same week, ask whether your incident response plan has a documented process for treating a confirmed active-exploitation advisory as a possible-compromise event, not only a patch ticket.
Request an inventory of who owns patching for backup software specifically, since it is easy to treat backup infrastructure as "set and forget" once it is running.

Watch List

Whether the Department of Defense's CMMC Reform Task Force publishes its expected recommendations on a Phase 2 replacement, reported to land sometime between mid-September and early October 2026; see our prior brief if you hold or pursue DoD contracts.
Whether Debian, Ubuntu, and other non-Red Hat Linux distributions confirm and ship their own backported fixes for CVE-2025-39682 ahead of, or shortly after, the September 21 federal deadline.
Whether Acronis extends its confirmed active-exploitation finding to Plesk deployments, which it says it has not observed as of this week.
The September 30 Entra Connect Sync deadline itself, now the closest hard date on this list.

The Bottom Line

Two Cisco products hitting maximum or near-maximum severity with confirmed active exploitation in the same week is a reminder that "actively exploited" is not a rare label anymore; it is a weekly occurrence businesses need a standing process to catch, not a special event to react to one advisory at a time. The Acronis and Linux kernel items this week add a second lesson: the systems protecting you, your backup software and the servers underneath your applications, need the same patch discipline as your perimeter firewall, because an attacker who compromises either one gains more than a foothold. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions helps commercial businesses build and document that process through our managed cybersecurity and managed IT services, backed by IT and security assessments that inventory the appliances, servers, and backup infrastructure covered this week, our backup and disaster recovery service and backup readiness assessment, and our FTC Safeguards Rule and GLBA compliance and HIPAA Security Rule compliance programs that document the response for you.