Daily brief · 2026-09-14 · updated 2026-10-12

6 Critical Security Fixes You Need Today

▶

ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS

CISA’s Known Exploited Vulnerabilities catalog lists exploited vulnerabilities affecting ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS. ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation, and ScreenConnect CVE-2026-84869 can enable unauthorized file transfer and execution during active remote sessions. Artifactory CVE-2026-42016 is an authorization flaw that can lead to privilege escalation, and Artifactory CVE-2026-42018 can expose sensitive resources through an anonymous-user token returned to an unauthenticated caller. RouterOS CVE-2026-86060 can lead to privilege escalation by changing the trusted RouterOS policy mask, and RouterOS CVE-2026-67277 can disclose kernel memory and cause denial of service in btest.

Why it matters: Affected organizations face unauthorized remote-session actions, privilege escalation, sensitive-resource exposure, kernel-memory disclosure, or denial of service.

What to do: Apply the vendors’ fixes or CISA-required mitigations on internet-facing and high-value deployments first.

CVEs: CVE-2026-84869, CVE-2026-42016, CVE-2026-42018, CVE-2026-86060, CVE-2026-67277

GitLab Community Edition and Enterprise Edition

GitLab Community Edition and Enterprise Edition had a CVSS 10.0 unauthenticated path-traversal flaw in the repository commits API that CISA added to KEV. GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API. CISA KEV describes an unauthenticated arbitrary-file-read path traversal in GitLab CE/EE, and the GitLab vulnerability is rated CVSS 10.0. GitLab released fixes in versions 19.3.2, 19.2.6, and 19.1.8.

Why it matters: An unauthenticated attacker can read arbitrary files from an affected GitLab server.

What to do: Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 or later according to the applicable release line.

CVEs: CVE-2026-85706

Google Chromium V8 / Google Chrome

CISA KEV lists an actively exploited Chromium V8 out-of-bounds write that can enable code execution in the sandbox, while Chrome 153.0.8010.36/.37 was released. In Google Chromium V8 / Google Chrome, Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chrome 153 was promoted to the stable channel for desktop platforms. The KEV-listed Chromium flaw is an out-of-bounds write that enables sandboxed code execution through crafted HTML.

Why it matters: A remote attacker may execute arbitrary code inside the browser sandbox.

What to do: Update Chrome to the current stable release supplied for the operating system and confirm enterprise browser-update rollout.

CVEs: CVE-2026-87491

Cisco Secure Firewall Management Center Software and Cisco Security Cloud Control Firewall Management

Cisco Secure Firewall Management Center Software and Cisco Security Cloud Control Firewall Management have a pre-authentication web-interface bypass that can let a remote attacker execute scripts and obtain root access, and CISA KEV lists it. A vulnerability in the web interface of Cisco Secure Firewall Management Center, FMC, Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. The flaw can permit unauthenticated remote bypass, script execution, and root access on affected FMC devices. CISA KEV also covers Cisco Secure FMC and Cisco Security Cloud Control Firewall Management.

Why it matters: An unauthenticated remote attacker can obtain root access to the underlying operating system.

What to do: Apply Cisco’s security update or mitigation for CVE-2026-20079 on every affected FMC/SCC management deployment.

CVEs: CVE-2026-20079

Also today

Citrix NetScaler ADC and NetScaler Gateway

CISA KEV lists an authentication-bypass flaw in Citrix NetScaler ADC and NetScaler Gateway that can affect appliances configured for AAA or Gateway services.

What to do: Apply Citrix remediation for CVE-2026-19490 and prioritize externally exposed AAA, SSL VPN, ICA Proxy, CVPN, and RDP Proxy deployments.

CVEs: CVE-2026-19490

Fortinet FortiOS, FortiSwitchManager, and FortiSASE

CISA KEV lists a heap-based buffer overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE that can permit unauthorized code or command execution.

What to do: Apply Fortinet’s remediation for CVE-2025-25249 and prioritize reachable management and edge systems.

CVEs: CVE-2025-25249

Tags: connectwise-screenconnect-jfrog-artifactory-and-mikrotik-routeros, gitlab-community-edition-and-enterprise-edition, google-chromium-v8, cisco-secure-firewall-management-center-software-and-cisco-security-cloud-contro, citrix-netscaler-adc-and-netscaler-gateway, fortinet-fortios-fortiswitchmanager-and-fortisase