Daily brief · 2026-09-13 · updated 2026-10-12

6 Critical Security Fixes You Need Today

▶

ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS

CISA’s Known Exploited Vulnerabilities catalog included ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS vulnerabilities in its September 2026 catalog updates. ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to perform file transfer and execution through active remote sessions without authorization or host confirmation. CVE-2026-84869 affects ConnectWise ScreenConnect and can permit unauthorized file transfer and execution through active remote sessions. CVE-2026-42016 is an Artifactory authorization issue that can lead to privilege escalation, CVE-2026-42018 can disclose an internal anonymous-user token to an unauthenticated caller, and CVE-2026-67277 affects MikroTik RouterOS btest and can disclose kernel memory or cause denial of service.

Why it matters: Affected systems may permit unauthorized remote-session actions, privilege escalation, resource exposure, or RouterOS memory disclosure and denial of service.

What to do: Apply the relevant vendor updates and meet the CISA KEV remediation deadlines for affected products.

Microsoft Windows Update Stack and Windows ALPC

Microsoft identified two exploited local Windows elevation-of-privilege vulnerabilities in Microsoft Windows Update Stack and Windows ALPC. Improper link resolution before file access, called link following, in Windows Update Stack allows an authorized attacker to elevate privileges locally. CVE-2026-81963 permits local privilege elevation through Windows Update Stack link following. CVE-2026-85880 is a Windows ALPC heap-based buffer overflow that permits local privilege elevation and can allow AppContainer escape without additional user interaction.

Why it matters: An attacker with authorized local execution can elevate privileges, including potentially escaping a low-privilege AppContainer.

What to do: Deploy Microsoft’s September security updates for affected Windows systems on an expedited basis.

Check Point Quantum Security Gateway and Quantum Security Management

Two critical Check Point VPN-related vulnerabilities permit unauthenticated remote code execution on affected Check Point Quantum Security Gateway and Quantum Security Management systems. Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. CVE-2026-85102 is rated CVSS 9.8 and affects specified Check Point Quantum Security Gateway releases. CVE-2026-85103 can permit unauthenticated remote code execution on Quantum Security Management and Gateway systems.

Why it matters: An unauthenticated remote attacker may execute arbitrary code on affected Check Point systems.

What to do: Apply Check Point’s remediations for the affected Gateway and Management versions. Treat claims of imminent exploitation as a forecast unless confirmed by an authoritative exploitation source.

Cisco Secure Firewall Management Center and Cisco Security Cloud Control Firewall Management

Cisco Secure Firewall Management Center and Cisco Security Cloud Control Firewall Management had an actively exploited authentication-bypass vulnerability that could yield root access. Cisco Secure Firewall Management Center Software and Cisco Security Cloud Control Firewall Management contain an authentication bypass using an alternate path or channel that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Cisco’s advisory says the flaw permits an unauthenticated remote attacker to bypass authentication and obtain root access. Cisco released updates and states no workaround exists.

Why it matters: An unauthenticated remote attacker can obtain root access to the underlying operating system.

What to do: Install Cisco’s security updates immediately. Cisco states that no workaround addresses the flaw.

GitLab Community Edition and Enterprise Edition

GitLab CE/EE had a CVSS 10.0 unauthenticated arbitrary-file-read vulnerability that CISA added to KEV. GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. GitLab released fixed CE/EE versions 19.3.2, 19.2.6, and 19.1.8. The flaw enabled unauthenticated arbitrary-file reads under certain conditions.

Why it matters: An unauthenticated attacker can read arbitrary files from an affected GitLab server.

What to do: Upgrade GitLab CE/EE to 19.3.2, 19.2.6, or 19.1.8, as applicable.

Trezor customers and Brevo, Trezor’s third-party marketing email provider

Trezor confirmed that its third-party marketing email provider Brevo was breached, affecting 347,000 subscribers and enabling phishing emails. Trezor customers and Brevo, Trezor’s third-party marketing email provider, were affected after Brevo was breached in an attack. The breach affected 347,000 subscribers. Trezor warned that a named security-alert email was phishing and told recipients not to click its links.

Why it matters: Subscribers could receive fraudulent security-alert emails intended to induce link clicks.

What to do: Do not click links in the identified phishing message. Verify Trezor communications through trusted channels.

Also today

Google Chromium

CISA added Google Chromium CVE-2026-87491 to KEV based on evidence of active exploitation. The alleged BlueMoon Chrome-to-Windows chain is unverified.

What to do: Update Chromium-based browsers according to the vendor’s security guidance. Prioritize systems exposed to browser exploitation.

Tags: connectwise-screenconnect-jfrog-artifactory-and-mikrotik-routeros, microsoft-windows-update-stack-and-windows-alpc, check-point-quantum-security-gateway-and-quantum-security-management, cisco-secure-firewall-management-center-and-cisco-security-cloud-control-firewal, gitlab-community-edition-and-enterprise-edition, trezor-customers-and-brevo-trezor-s-third-party-marketing-email-provider, google-chromium