Back to Archive
THREAT INTELLIGENCE BRIEF·Thursday, September 10, 2026·AI-Powered

This threat briefing highlights multiple actively exploited vulnerabilities confirmed by CISA, demanding immediate attention.

This threat briefing highlights multiple actively exploited vulnerabilities confirmed by CISA, demanding immediate attention. The highest priority is a critical authentication bypass in Cisco Secure Firewall Management Center (CVE-2026-20079), which is listed on the CISA KEV catalog and requires patching by September 12, 2026. Also requiring immediate action are a Chrome V8 zero-day (CVE-2026-87491) and a Fortinet code execution flaw (CVE-2025-25249), both confirmed as actively exploited. A new zero-day in Microsoft Defender and a significant third-party data breach at Veradigm round out the top threats.

59 articles analysed3 CVEs mentioned

Threat Categories

🐛Vulnerabilities4
🔒Ransomware1

Article Analyses (5)

[CRITICAL] "Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks"

critical
CVE-2026-20079
KEVEPSS 35.9%

Details

A maximum-severity authentication bypass vulnerability in Cisco's Secure Firewall Management Center (FMC) software is confirmed to be actively exploited. This flaw could allow an unauthenticated, remote attacker to gain unauthorized access to the device.

Affected Systems

Cisco Secure Firewall Management Center (FMC) software

Potential Impact

Compromise of network security management, allowing attackers to alter firewall policies, monitor traffic, and pivot to other network segments. This represents a critical risk to network integrity and data confidentiality.

Mitigations

Apply patches immediately. Per CISA's Known Exploited Vulnerabilities (KEV) catalog, federal agencies must remediate this vulnerability by September 12, 2026.

BleepingComputerDraft Post

[CRITICAL] "Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox"

critical
CVE-2026-87491
KEVEPSS 0.3%

Details

A medium-severity, out-of-bounds write vulnerability in the V8 JavaScript engine allows for code execution. This zero-day flaw is being actively exploited in the wild, likely through malicious websites targeting Chrome users.

Affected Systems

Google Chrome versions prior to the latest release.

Potential Impact

Successful exploitation could lead to arbitrary code execution on user workstations, enabling attackers to install malware, steal credentials, or perform surveillance. Widespread impact due to Chrome's large user base.

Mitigations

Update all instances of Google Chrome to the latest version immediately. Per CISA's KEV catalog, federal agencies must remediate this vulnerability by September 23, 2026.

The Hacker NewsDraft Post

[HIGH] "Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks"

high
CVE-2025-25249
KEVEPSS 0.8%

Details

A high-severity, unauthenticated vulnerability patched in January 2026 is now being exploited in attacks deploying the PivotC2 Remote Access Trojan (RAT). This allows attackers to execute arbitrary code on affected Fortinet appliances.

Affected Systems

Multiple Fortinet products (specifics in vendor advisory).

Potential Impact

Full system compromise of affected Fortinet appliances, enabling attackers to establish persistent access, exfiltrate data, and move laterally within the network.

Mitigations

Ensure the patch released in January 2026 has been applied. Per CISA's KEV catalog, federal agencies must remediate this vulnerability by September 12, 2026. Hunt for indicators of compromise associated with PivotC2 RAT.

SecurityWeekDraft Post

[HIGH] "New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access"

high

Details

A security researcher has publicly released a new zero-day exploit named 'ShieldCrash' that affects Microsoft Defender. The exploit can allegedly grant SYSTEM-level access, effectively bypassing endpoint security controls.

Affected Systems

Microsoft Defender Antivirus.

Potential Impact

An attacker with local access could elevate privileges to the highest level (SYSTEM), rendering the primary endpoint security solution ineffective and allowing for complete system takeover.

Mitigations

Monitor for official guidance and a patch from Microsoft. Review endpoint detection and response (EDR) logs for anomalous behavior related to Microsoft Defender processes. Await vendor patch and be prepared for emergency deployment.

BleepingComputerDraft Post

[CRITICAL] "Veradigm warns of patient data breach after ransomware gang claims attack"

critical

Details

Healthcare technology company Veradigm has disclosed a data breach resulting from a cyberattack at a third-party vendor. A ransomware gang has claimed responsibility for the attack, exposing sensitive patient data.

Affected Systems

Veradigm (via a third-party vendor).

Potential Impact

Reputational damage, regulatory fines (e.g., HIPAA), and potential legal action. The exposed data, including Social Security Numbers, puts affected patients at high risk of identity theft and fraud.

Mitigations

Review third-party vendor risk management processes. Identify any exposure to Veradigm or the involved third-party vendor. Monitor for updates from Veradigm regarding the scope and specifics of the breach.

BleepingComputerDraft Post
Generated by gemini-2.5-pro