CISA KEV Flash: 7 CVEs Added — Cisco Edge, Linux Kernel, Acronis & Pixel Under Active Attack | Security Arsenal

Alert level: Critical. CISA has confirmed active exploitation for seven vulnerabilities across network edge identity/email, Linux estates, web-hosting backup plugins, and Google Pixel cellular modem code. Treat internet-facing Cisco Secure Email Gateway and Identity Services Engine as emergency change items, then drive kernel and control-panel remediation through the same maintenance window.

Executive blast radius

This wave is operationally dangerous because it pairs pre-authentication edge exposure with local privilege escalation primitives and backup-plane weakness. CVE-2026-76461 gives remote unauthenticated actors a SQL injection path into Cisco AsyncOS for Secure Email Gateway. CVE-2026-76460 hits Cisco ISE/ISE-PIC, where privileged API misuse can turn a foothold into control over network admission policy. CVE-2026-87886 weakens Acronis backup integrations for cPanel/WHM and Plesk, a classic ransomware precursor: discover backups, weaken restore, then encrypt. The Linux kernel entries are not abstract hardening bugs; AF_ALG, ebtables SNAT, and kTLS receive-path flaws map to container hosts, virtualization nodes, VPN/edge appliances built on Linux, and high-throughput TLS terminators. Pixel modem authorization bypass matters for executives, journalists, and mobile-heavy field staff exposed to targeted intrusion.

CISA binding operational directive planning assumption: additions on 2026/09/14 are due for federal remediation around 2026/10/05, additions on 2026/09/16 around 2026/10/07, and additions on 2026/09/18 around 2026/10/09 unless the KEV entry specifies a different date. The catalog date controls for federal agencies; enterprises should adopt the same deadlines internally.

Active Exploitation Intelligence

CVE-2026-76461 — Cisco AsyncOS for Secure Email Gateway SQL injection

What it is: Cisco AsyncOS software for Cisco Secure Email Gateway contains a SQL injection vulnerability reachable by an unauthenticated remote attacker. Email gateways sit at the trust boundary and process hostile content by design, which makes pre-auth injection especially attractive.
Exploitation method: Remote unauthenticated SQL injection against management or user-facing web services. Expected outcomes include credential and session theft, policy tampering, extraction of directory data, creation of rogue admin or API access, message routing changes, and possible command execution if the database account or stored procedures are over-privileged.
Threat actors/ransomware: CISA confirms active exploitation; no named actor was included in the provided KEV feed. Email-security compromise is routinely used by initial access brokers and ransomware affiliates for mailbox rules, outbound relay abuse, and credential harvesting.
CVSS/PoC: CVSS and public PoC status were not included in the feed. Treat as critical even if a score is pending because exploitation is confirmed and the path is unauthenticated.
Required action: Apply Cisco fixed software immediately, restrict SEG admin interfaces to a dedicated management network, review admin accounts/API keys/message filters, rotate directory and SMTP credentials, and hunt for webshells or unusual Java/Tomcat child processes.

CVE-2026-76460 — Cisco ISE and ISE-PIC incorrect use of privileged APIs

What it is: Cisco Identity Services Engine and ISE Passive Identity Connector contain an incorrect use of privileged APIs vulnerability. ISE is the policy brain for NAC, TrustSec, guest access, and posture; compromise can silently reshape who is allowed on the network.
Exploitation method: Abuse of privileged API behavior to execute actions outside intended authorization, potentially escalating from an authenticated service context to high-impact administrative or OS-level operations depending on deployment hardening. Even without full RCE, policy manipulation can disable port security, whitelist attacker MAC addresses, or bypass quarantine.
Threat actors/ransomware: Active exploitation confirmed by KEV; actor attribution not provided. ISE is a high-value target for intrusions that need lateral movement without tripping 802.1X controls.
CVSS/PoC: Not specified in the feed. Prioritize as critical for any ISE node reachable from user VLANs, partner networks, or broad admin subnets.
Required action: Patch ISE and ISE-PIC, isolate PAN/MNT/PSN roles, enforce MFA and RBAC for admin portals, audit external REST/ERS usage, disable unused APIs, rotate certificates and service accounts, and review recent authorization policy changes.

CVE-2026-87886 — Acronis Backup plugin for cPanel/WHM and Plesk incorrect default permissions

What it is: Acronis Backup integrations for cPanel/WHM and Plesk ship with incorrect default permissions that could allow unauthorized access or modification. Shared-hosting control panels concentrate many tenants and backup jobs on one attack surface.
Exploitation method: Local or web-adjacent abuse of overly permissive plugin files, credentials, configuration, or backup metadata. Likely impact includes backup discovery, deletion or encryption of restore points, theft of hosted-site secrets, and persistence inside panel plugin directories.
Threat actors/ransomware: Active exploitation confirmed; no gang named in the feed. Backup tampering is a standard ransomware precursor, especially against MSPs and hosting providers where one panel equals many victims.
CVSS/PoC: Not specified in the feed. Public exploitability is plausible because hosting plugins are frequently scanned and misconfiguration is easy to weaponize.
Required action: Update the Acronis plugin/extension, correct ownership and modes on plugin and backup configuration paths, remove world-readable secrets, audit recent backup job deletion/retention changes, and verify offline immutable copies exist before attackers test restore denial.

CVE-2025-39964 — Linux kernel AF_ALG race condition

What it is: A race condition where concurrent writes to the same AF_ALG socket make data unpredictable. AF_ALG exposes kernel crypto to userland and is reachable in many minimal container and appliance builds.
Exploitation method: Local race-triggered state confusion. The practical path is an unprivileged local process or container escape attempt racing AF_ALG operations to corrupt kernel state, cause denial of service, and potentially build toward privilege escalation when combined with heap grooming and namespace weaknesses.
Threat actors/ransomware: KEV confirms active exploitation; attribution unknown. Linux LPE primitives are valuable after web or CI/CD compromise and are frequently chained with container breakout techniques.
CVSS/PoC: Not specified in the feed. Assume exploit chains exist if CISA lists observed use.
Required action: Patch kernels through the distribution channel, reboot into the fixed kernel, restrict unprivileged user namespaces where business impact allows, blacklist af_alg on hosts that do not require kernel crypto sockets, and monitor for namespace creation plus kernel oops correlation.

CVE-2026-53266 — Linux kernel ebtables SNAT target out-of-bounds write

What it is: An out-of-bounds write in the ebtables SNAT target involving ARP sender hardware address rewrite behavior. This is Layer-2 netfilter territory: bridges, hypervisors, Kubernetes nodes with bridging, virtual network appliances, and legacy ebtables users are most relevant.
Exploitation method: An attacker with local netfilter configuration influence or a position to inject crafted ARP on a bridged segment can trigger the SNAT target path and cause memory corruption. Impact ranges from kernel panic to privilege escalation depending on mitigations and kernel build options.
Threat actors/ransomware: Active exploitation confirmed; actor unknown. Watch virtualization and telecom environments where ebtables/bridge-nf configurations persist long after iptables migration.
CVSS/PoC: Not specified in the feed. Treat bridge-heavy production nodes as urgent because an OOB write in netfilter is a strong LPE/DoS primitive.
Required action: Patch and reboot, migrate legacy ebtables rules to nftables where supported, remove SNAT target rules not strictly required, segment L2 domains, and alert on ebtables or bridge-nf changes outside change windows.

CVE-2025-39682 — Linux kernel TLS receive path exceptional-condition flaw

What it is: Improper handling of unusual or exceptional conditions in the kernel TLS receive path involving zero-length input. kTLS is used to accelerate TLS in kernel space for performance-sensitive services.
Exploitation method: A remote peer can likely influence the receive path by sending malformed or edge-case TLS records to services using kTLS. Expected near-term impact is denial of service through panic or resource failure; memory-safety escalation depends on exact code path and mitigations.
Threat actors/ransomware: Active exploitation confirmed; attribution not provided. High-volume TLS terminators and appliances should assume probing will follow quickly.
CVSS/PoC: Not specified in the feed. Even a DoS-only result is material for payment gateways, API edges, VPN concentrators, and storage replication using kTLS.
Required action: Patch kernels, inventory kTLS usage, temporarily disable kTLS offload where patching is delayed, rate-limit malformed TLS at the edge, and watch for repeated TLS session resets followed by kernel errors.

CVE-2026-58704 — Google Pixel cellular modem improper authorization

What it is: Pixel devices contain an improper authorization vulnerability in the cellular modem where a logic error may allow bypass of permission checks. Modem flaws are sensitive because baseband sits below Android userland and touches identity, location, voice, SMS, and data paths.
Exploitation method: Likely local-to-device or radio-adjacent logic abuse that bypasses expected authorization boundaries between Android components and modem interfaces. The exact trigger was not included in the KEV feed.
Threat actors/ransomware: Active exploitation confirmed; actor unknown. Mobile zero-days are more often associated with targeted spyware than mass ransomware, but executive device compromise can feed business email compromise and extortion.
CVSS/PoC: Not specified in the feed. Do not wait for public PoC for high-risk users.
Required action: Enroll Pixels in managed updates, force the September 2026 or later security patch level, reboot devices after update, restrict high-risk users from sideloading, enable Play Protect and advanced protection, and review anomalous baseband crashes or unexpected mobile-data behavior.

Affected Organizations Assessment

Most exposed environments: organizations with Cisco SEG at the mail edge; ISE or ISE-PIC enforcing NAC across campuses; MSPs and hosting providers running cPanel/WHM or Plesk with Acronis plugins; Linux-heavy estates with container platforms, hypervisors, network appliances, kTLS terminators, or long-lived vendor kernels; and mobile fleets with executives or field staff on Pixel devices.

Exposure scale and patch drag: internet email gateways and ISE nodes are usually few in count but high in blast radius; patch adoption can be slowed by change control, redundancy testing, and fear of mail flow or NAC outage. Linux kernel risk is broader and slower: cloud images and managed nodes patch quickly, while appliances, embedded Linux, OT-adjacent jump boxes, and pinned container host kernels lag for weeks. Shared-hosting panels often run many small instances with weak ownership, making Acronis plugin permission defects easy to miss. Pixel exposure is smaller but concentrated in high-value users and can persist if devices are not MDM-enrolled.

Fastest exploitation pressure by sector: financially motivated groups historically move fastest against email edge, hosting panels, backup infrastructure, and remote access services. Healthcare, legal, insurance, education, manufacturing, and local government should assume scanning within hours because they combine high outage sensitivity with slower maintenance windows. Telecom, cloud, and managed service providers should prioritize Linux netfilter/kTLS and ISE because one compromise can become multi-customer lateral movement.

Detection Engineering

YAML

---
title: Linux Kernel Exploit Primitive Behavior - AF_ALG ebtables kTLS
id: 9f6a0d2a-7c4b-4d1e-9a11-20260918001
status: experimental
description: Detects local exploitation behavior relevant to CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 including namespace abuse, netfilter changes, kTLS module activity, and kernel memory-corruption signals.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection_namespace:
    - type: 'execve'
      exe|contains: '/usr/bin/unshare'
    - type: 'execve'
      exe|contains: '/usr/bin/nsenter'
  selection_netfilter:
    - type: 'execve'
      exe|contains: '/sbin/ebtables'
    - type: 'execve'
      exe|contains: '/usr/sbin/ebtables'
    - type: 'execve'
      exe|contains: '/usr/sbin/nft'
  selection_ktls:
    - type: 'execve'
      exe|contains: '/usr/sbin/modprobe'
      a0|contains: 'tls'
    - type: 'execve'
      exe|contains: '/usr/bin/openssl'
  condition: selection_namespace or selection_netfilter or selection_ktls
falsepositives:
  - Legitimate container orchestration, network automation, and kernel maintenance
level: high
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/09/18
modified: 2026/09/18
---
title: Linux Kernel Memory Corruption and Netfilter Anomaly
id: 9f6a0d2a-7c4b-4d1e-9a11-20260918002
status: experimental
description: Surfaces kernel oops, BUG, AF_ALG, ebtables, bridge-nf, and TLS receive-path errors that may follow exploitation of Linux KEV entries in this wave.
author: Security Arsenal Threat Intel
logsource:
  product: linux
  service: syslog
detection:
  selection_kernel_errors:
    SyslogMessage|contains:
      - 'BUG:'
      - 'Oops:'
      - 'general protection fault'
      - 'KASAN'
      - 'out-of-bounds'
      - 'AF_ALG'
      - 'ebtables'
      - 'bridge-nf'
      - 'tls'
  filter_expected_updates:
    SyslogMessage|contains:
      - 'packagekit'
      - 'unattended-upgrade'
  condition: selection_kernel_errors and not filter_expected_updates
falsepositives:
  - Driver faults, hardware errors, kernel debugging, and crash dump collection
level: high
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/09/18
modified: 2026/09/18
---
title: Cisco SEG ISE and Acronis Panel Web Exploitation Behavior
id: 9f6a0d2a-7c4b-4d1e-9a11-20260918003
status: experimental
description: Detects SQL injection probes, suspicious process spawning from web services, and permission tampering aligned to CVE-2026-76461, CVE-2026-76460, and CVE-2026-87886.
author: Security Arsenal Threat Intel
logsource:
  category: webserver
detection:
  selection_sqli:
    cs-uri-query|contains:
      - '%27'
      - '%22'
      - 'union%20select'
      - 'select%20'
      - 'information_schema'
      - 'sleep('
      - 'benchmark('
      - 'or%201=1'
  selection_targets:
    cs-host|contains:
      - 'ise'
      - 'seg'
      - 'esa'
      - 'cpanel'
      - 'whm'
      - 'plesk'
  selection_methods:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
  condition: selection_sqli and selection_targets and selection_methods
falsepositives:
  - Vulnerability scanners and poorly coded integrations
level: critical
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/09/18
modified: 2026/09/18

KQL — Microsoft Sentinel / Defender

let Lookback = 7d;
let SqliTerms = dynamic(['%27','%22','union%20select','select%20','information_schema','sleep(','benchmark(','or%201=1']);
let EdgeTerms = dynamic(['ise','seg','esa','cpanel','whm','plesk']);
let LinuxTerms = dynamic(['unshare','nsenter','ebtables','bridge-nf','modprobe tls','af_alg','chmod 777','curl ','wget ']);
union isfuzzy=true
(DeviceProcessEvents
 | where TimeGenerated >= ago(Lookback)
 | where ProcessCommandLine has_any (LinuxTerms)
    or (InitiatingProcessFileName in~ ('java','tomcat','httpd','nginx','php-fpm','plesk','sw-engine') and ProcessCommandLine has_any (dynamic(['sh -c','bash -c','python','perl','curl','wget','chmod','chown'])))
 | project TimeGenerated, DeviceName, AccountName, ProcessFileName=FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId),
(DeviceNetworkEvents
 | where TimeGenerated >= ago(Lookback)
 | where RemoteUrl has_any (EdgeTerms) and RemotePort in (80,443,8443,2082,2083,2086,2087,8880)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType, ReportId),
(Syslog
 | where TimeGenerated >= ago(Lookback)
 | where SyslogMessage has_any (dynamic(['BUG:','Oops:','general protection fault','out-of-bounds','AF_ALG','ebtables','bridge-nf','tls','audit:']))
 | project TimeGenerated, HostName, ProcessName, SyslogMessage, SeverityLevel),
(CommonSecurityLog
 | where TimeGenerated >= ago(Lookback)
 | where RequestMethod in~ ('POST','PUT','DELETE')
 | where RequestURL has_any (SqliTerms) or RequestURL has_any (EdgeTerms)
 | project TimeGenerated, DeviceProduct, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, ReceivedBytes)
| order by TimeGenerated desc

Bash / Shell

#!/usr/bin/env bash
set -u
APPLY=${APPLY:-0}
REBOOT=${REBOOT:-0}
FIXED_KERNEL=${FIXED_KERNEL:-CHANGE_ME_FROM_VENDOR_ADVISORY}
OUT=${OUT:-/tmp/kev_linux_inventory.csv}
echo host,os,kernel,fixed_kernel,needs_kernel_reboot,af_alg_loaded,tls_loaded,ebtables_present,unprivileged_userns,risk > $OUT
need_cmd() { command -v $1 >/dev/null 2>&1 || echo missing:$1; }
for host in $(cat ${HOSTS:-/dev/stdin}); do
  ssh -o BatchMode=yes -o ConnectTimeout=8 $host '
    os=$( (grep PRETTY_NAME /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d \'') 2>/dev/null || echo unknown )
    k=$(uname -r)
    fixed=${FIXED_KERNEL:-CHANGE_ME_FROM_VENDOR_ADVISORY}
    rebootflag=unknown; [ "$k" = "$fixed" ] && rebootflag=no || rebootflag=yes
    afalg=no; lsmod 2>/dev/null | grep -qi '^af_alg' && afalg=yes
    tls=no; lsmod 2>/dev/null | grep -qi '^tls' && tls=yes
    ebt=no; command -v ebtables >/dev/null 2>&1 && ebt=yes; [ -e /proc/net/eb_SDNAT ] || [ -e /proc/sys/net/bridge/bridge-nf-call-iptables ] && ebt=yes
    userns=kernel_default; [ -r /proc/sys/kernel/unprivileged_userns_clone ] && userns=$(cat /proc/sys/kernel/unprivileged_userns_clone)
    risk=review; [ "$rebootflag" = yes ] && risk=high; [ "$ebt" = yes ] && risk=high; [ "$afalg" = yes ] && risk=high
    printf '%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n' $(hostname -s) "$os" $k $fixed $rebootflag $afalg $tls $ebt $userns $risk
  ' FIXED_KERNEL=$FIXED_KERNEL >> $OUT 2>/dev/null || echo $host,ssh_failed,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unreachable >> $OUT
done
cat $OUT
if [ $APPLY -eq 1 ]; then
  echo Applying distribution kernel updates where supported. Set FIXED_KERNEL first and reboot only with approval.
  for host in $(cat ${HOSTS:-/dev/stdin}); do
    ssh -o BatchMode=yes $host '
      if command -v apt-get >/dev/null 2>&1; then apt-get update -y && apt-get install --only-upgrade -y linux-image-$(uname -r) linux-headers-$(uname -r) 2>/dev/null || true; fi
      if command -v dnf >/dev/null 2>&1; then dnf upgrade -y kernel kernel-core kernel-modules 2>/dev/null || true; fi
      if command -v yum >/dev/null 2>&1; then yum update -y kernel 2>/dev/null || true; fi
      [ -w /etc/modprobe.d/kev-blacklist.conf ] || true
      grep -q 'blacklist af_alg' /etc/modprobe.d/kev-blacklist.conf 2>/dev/null || echo 'blacklist af_alg' >> /etc/modprobe.d/kev-blacklist.conf 2>/dev/null || true
      [ -w /proc/sys/kernel/unprivileged_userns_clone ] && echo 0 > /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || true
      command -v ebtables >/dev/null 2>&1 && ebtables -L 2>/dev/null | grep -i snat | sed 's/^/review_snat_rule:/' || true
      echo post_change_kernel=$(uname -r)
    ' || true
  done
  [ $REBOOT -eq 1 ] && echo Reboot approved by operator; schedule reboots to enter fixed kernel.
fi
echo Validate: uname -r equals FIXED_KERNEL, af_alg and unused tls modules absent, ebtables SNAT removed, unprivileged_userns_clone is 0, and no new kernel Oops appears during soak.

Patch & Remediation Priorities

Cisco Secure Email Gateway — CVE-2026-76461. Patch first because it is unauthenticated, remote, and sits on hostile traffic. Use Cisco fixed AsyncOS releases from the Cisco Security Advisories page and PSIRT process. Workaround if patching is delayed: block management and user portals from untrusted networks, enforce admin VPN allowlists, disable unused features, place a WAF in front only as a temporary compensating control, and rotate credentials after patching.
Cisco ISE/ISE-PIC — CVE-2026-76460. Patch in the same window if ISE is reachable from user or partner networks. Segment PAN, MNT, and PSN roles; restrict ERS/OpenAPI to approved automation; audit authorization-policy and endpoint-whitelist changes; rotate service accounts and certificates.
Acronis Backup cPanel/WHM and Plesk extensions — CVE-2026-87886. Update plugin/extension packages, then manually verify permissions because incorrect defaults can survive upgrades. Remove world-readable backup configs and keys, restrict panel plugin CGI paths, review retention/deletion logs, and prove one offline immutable restore before considering the issue closed.
Linux kernel trio — CVE-2025-39964, CVE-2026-53266, CVE-2025-39682. Patch edge, container, hypervisor, VPN, storage, and kTLS nodes first; then broad server fleets. Use RHEL, Ubuntu, Debian, SUSE, Amazon Linux, or vendor appliance channels rather than waiting for generic distribution lag. Workarounds: disable unprivileged user namespaces where feasible, blacklist af_alg if unused, remove legacy ebtables SNAT rules and migrate to nftables, and temporarily disable kTLS on critical terminators if crashes are observed.
Google Pixel — CVE-2026-58704. Enforce current Android security patch level via MDM, prioritize high-risk users, require reboot after update, and review sideloading and unknown-source settings.

Vendor and compliance links: CISA KEV catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog; Cisco security advisories and PSIRT at https://sec.cloudapps.cisco.com/security/center/publicationListing.x and https://www.cisco.com/go/psirt; Android/Pixel bulletins at https://source.android.com/docs/security/bulletin and Pixel update guidance at https://support.google.com/pixelphone/answer/4457705; Acronis product updates at https://www.acronis.com/en-us/support/updates/; kernel and distribution tracking at https://www.kernel.org/ plus your distro security tracker. Verify the exact fixed build from the vendor advisory before broad rollout, and document any deadline deviation against the KEV entry due date.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 7 CVEs Added — Cisco Edge, Linux Kernel, Acronis & Pixel Under Active Attack