KEV Intelligence Brief — September 18, 2026

Prepared by: Cyber Threat Intelligence · Classification: TLP:WHITE · Audience: Federal Contractors, DevOps, SOC Leadership

CISA added eight vulnerabilities to the Known Exploited Vulnerabilities catalog this week spanning Linux kernel internals, enterprise network infrastructure, mobile endpoints, developer toolchains, and hosting control panels. The breadth is notable: these are not peripheral or niche systems. Taken together, they reflect active adversary interest in privilege escalation paths across the full stack — from kernel sockets to artifact repositories to email gateways. Federal agencies and contractors operating under BOD 26-04 should treat the two September 17 deadlines below as already overdue and act immediately on all remaining windows.

Deadline Watch: Cisco and Google — Two Deadlines Already Passed, One Imminent

Three of the most operationally dangerous entries in this batch carried a September 17 patch deadline for Cisco's Secure Email Gateway (CVE-2026-76461) — a deadline that has already elapsed. The vulnerability is a SQL injection flaw in Cisco AsyncOS that permits an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying OS. This is a textbook critical-severity entry: no authentication required, remote exploitation, and full OS compromise as the outcome. Any organization with internet-facing Cisco Secure Email Gateway appliances that has not patched or isolated them is in active violation of BOD 26-04 obligations and should treat this as an incident-level response, not a patching backlog item. Network segmentation and interface restriction are stopgap measures only — root-level command execution means the trust boundary is gone.

Carrying the same September 19 deadline are Cisco Identity Services Engine (CVE-2026-76460) and Google Pixel (CVE-2026-58704), alongside Acronis Backup (CVE-2026-87886). The Cisco ISE vulnerability is particularly high-stakes: ISE and ISE-PIC are zero-trust enforcement chokepoints in many federal and enterprise networks. An incorrect use of privileged APIs allows an unauthenticated remote attacker to bypass the web management interface entirely — effectively granting administrative access without credentials. Compromising ISE means an attacker can manipulate network access policy, pivot laterally under legitimate-looking posture assessments, or disable enforcement for other devices. Admins should immediately restrict management interface access to out-of-band networks and verify no unauthorized sessions or policy changes exist.

CVE-2026-58704 targets a logic error in the Google Pixel cellular modem firmware that allows privilege escalation by bypassing permission checks. Federal employees and contractors using Pixel devices in sensitive roles should apply September's Pixel security update before the Friday deadline. Organizations managing a mobile device fleet should confirm MDM enforcement and deprioritize any delayed rollout policies for this cycle.

Acronis Backup's incorrect default permissions flaw (CVE-2026-87886) affecting its cPanel/WHM plugin and Plesk extension rounds out this deadline cluster. Hosting providers and managed service providers running these stacks should audit plugin-level file permissions and apply the vendor patch immediately. The privilege escalation vector here likely targets shared-hosting environments where tenant-level access can be elevated to host-level control.