CVEasy Weekly

This Week in Exposure

Week 39 · 2026-W39 · September 21 to September 27, 2026

The boxes that enforce trust took the week's worst hits. An unauthenticated request now roots a Cisco identity engine, a crafted email roots a Cisco mail gateway, and one CAPWAP packet roots a FortiGate, three appliances whose whole job is to be the thing everything else defers to. Each of the three is already exploited in the wild, and each was on the CISA KEV catalog with a federal deadline that has already passed.

The base score barely separates them, two above 9.8 and one heap overflow that reads like any other, so the ranking below runs on where the appliance sits and what an attacker gets when it falls: the policy plane for a whole network, the front of every mailbox, the device that terminates the VPN. The fourth item is a different lesson, a GitHub token stolen in May that cloned 170 private repositories and stayed useful for four months, because a valid credential does not show up in any queue sorted by CVSS.

Top Exposures This Week

1. An unauthenticated request that roots the box deciding who your network trusts

CVE-2026-76460 · Cisco ISE and ISE-PIC · CVSS 10.0, unauthenticated, Scope Changed · CISA KEV since September 16

One route inside the ISE web application accepts an HTTP request without walking it through the authentication filter that guards every other privileged route. Send a message shaped the way that endpoint expects to a Policy Administration Node reachable over the network, and the front controller treats the sender as an already-authenticated administrator, from which they execute operating system commands as root. Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on September 16, rated it CVSS 10.0 with a Scope Changed vector, and said PSIRT was already aware of active exploitation. The reason this outranks a bare 10.0 is what the seat controls: ISE is the identity source of truth for the whole network, so an admin session can mint local administrator accounts, upload signed application bundles, edit the network device inventory, and push policy to every switch that trusts the deployment.

Risk read: Confirmed in the wild by Cisco PSIRT on disclosure day, no configuration workaround. CISA added CVE-2026-76460 to KEV the same day, September 16, with a September 19 remediation deadline for federal civilian agencies that has already passed. A queue sorted by CVSS files this flat beside every other unauthenticated RCE, which is exactly where the identity plane gets lost, because rooting a mail server costs you a mail server and rooting ISE costs you the policy that every switch, VPN, and 802.1X port in the estate obeys. Exposure is top band on any ISE or ISE-PIC node whose admin interface is reachable from a segment an attacker can touch, and a compromise there is an authentication-fabric event, not one appliance.

Read how one unprotected route roots the identity plane →

2. A crafted email that ends in a root shell on the Cisco mail gateway

CVE-2026-76461 · Cisco Secure Email Gateway, AsyncOS 15.5 and earlier, 16.0, 16.5 · CVSS 9.8, unauthenticated, CWE-89 · CISA KEV since September 14

A mail gateway is a small data platform pretending to be an SMTP relay. Every message it accepts gets normalized, then run past sender reputation, recipient validation, LDAP acceptance, and message tracking, all of which sit on an internal database that the parsing step feeds with fields pulled from the envelope, the headers, and the MIME parts. CVE-2026-76461 is a SQL injection (CWE-89) in that email parsing logic, so an unauthenticated attacker who can send mail to the listener injects into the query the gateway builds and walks out with command execution as root on the appliance itself. Affected trains are AsyncOS 15.5 and earlier, 16.0, and 16.5, on physical and virtual appliances regardless of feature configuration. There is no full workaround; the fixed builds are the fix.

Risk read: Cisco said it was already seeing the bug used against real customers before the patch shipped, and CISA added it to KEV the same day, September 14, with a September 17 federal deadline that has already passed. The gateway sits in front of every mailbox and holds the LDAP bind credentials, the message tracking store, and the position to read or rewrite inbound mail, so root here is a mail-interception and credential foothold, not a spam appliance outage. Exposure is top band on any Secure Email Gateway whose SMTP listener faces untrusted senders, which is the entire point of the device, so treat internet-reachable gateways as the priority population.

Read how one message roots the gateway →

3. One CAPWAP packet that turns a FortiGate into the attacker's pivot

CVE-2025-25249 · FortiGate cw_acd CAPWAP daemon, UDP 5246 · heap overflow, CWE-122, unauthenticated · CISA KEV since September 9

CAPWAP is the protocol a FortiGate speaks to act as a controller for wireless access points, and the daemon that handles it, cw_acd, listens on UDP port 5246. CVE-2025-25249 is a heap-based buffer overflow (CWE-122) in that daemon, reachable by a crafted CAPWAP request from an unauthenticated sender. One packet, and the operator has code execution on the device that terminates the VPN and enforces the segmentation policy. What SOCRadar's Threat Research Unit recovered makes it worse than a one-shot root: the PivotC2 implant, a Node.js payload pulled from the compromised firewalls, does not bring its own tunnel. It reuses the CAPWAP path the firewall already runs, on the same UDP 5246 that let the operator in, so internal traffic is sourced from the trusted firewall and reads as normal on the network.

Risk read: SOCRadar attributes a Russian-speaking cybercrime operation motivated by credential and configuration theft, with no state attribution and no MITRE ATT&CK group ID, so no nation-state frame is warranted. The campaign has run since July 2026, with 178 confirmed FortiGate infections, a recovered target list of more than 30,000 FortiGate IP addresses, and at least two intrusions ending in confirmed exfiltration. A firewall runs no endpoint agent, which is most of why the campaign lasted: little on the network could name what was wrong. CISA added CVE-2025-25249 to KEV on September 9 with a September 12 deadline that has already passed. Exposure is top band on any FortiGate whose CAPWAP daemon is reachable, and the pivot design means one compromised perimeter device is an interior access problem, not an edge one.

Read how the firewall becomes the tunnel →

4. A GitHub token that outlived the employee and cloned 170 private repos

CVE-2026-45321 · Stolen GitHub OAuth token via the @tanstack npm compromise · credential theft, no patch to apply · disclosed September 16

On May 11, 2026, the group tracked as TeamPCP (also UNC6780) published 84 malicious versions across 42 @tanstack/* packages, live for about six minutes before a StepSecurity researcher flagged them. Inside that window a CrowdSec engineer installed an affected release on a personal laptop, and the postinstall harvested a GitHub OAuth token beginning with gho_ alongside SSH keys and cloud material. Eleven days later, on May 22, an IP in Toronto used that token to clone about 170 private repositories from CrowdSec's GitHub organization, including the SaaS console, the AWS automation, and the data-science models behind the blocklist consensus. CrowdSec found out on September 16, when an engineer opened a cybercrime forum and saw the company's own source pasted in plaintext, with the gho_ token still sitting in a .git/config file.

Risk read: No exploit ran against a CVE here, and that is the point. The credential was valid, so the clone looked like ordinary Git traffic, and the gap between theft on May 22 and discovery on September 16 is roughly four months a scanner sorted by severity would never have flagged, because a working token carries no CVSS. The stolen laptop belonged to a former employee, so the token had also outlived the offboarding that should have killed it. Exposure lives wherever a developer machine that touched the poisoned packages held a long-lived OAuth token or SSH key, and the remediation is revocation and rotation, not a patch.

Read how a stale token stayed useful for four months →

Threat Actor Spotlight

TeamPCP, also tracked as UNC6780, is the group behind the @tanstack npm compromise that seeded this week's CrowdSec disclosure. The StepSecurity postmortem documents the campaign precisely: 84 malicious versions across 42 @tanstack/* packages published on May 11, 2026, each carrying a postinstall credential harvester that pulled GitHub tokens, SSH keys, and cloud material off any machine that installed one. The tell for defenders is patience. The malicious tarballs were live for minutes and pulled fast, which reads like a contained incident, and then the actual loss landed four months later when one harvested token cloned 170 private repositories. A queue that closes the ticket when the bad package is gone measures the wrong thing, because the package was only the delivery and the credential is the payload. Hardening takeaway: treat every developer OAuth token, SSH key, and cloud credential as revocable state, not standing access. Rotate on offboarding as a gate, not a chore, and rotate again on any npm or PyPI compromise that touched a machine which held those secrets, because the package being pulled does the credential no harm at all.

Signed CVEasy threat-intel IOC bundle current as of 2026-09-21. The desktop app verifies the ED25519 signature before import.

Three of this week's four are the appliances you bought to enforce trust, and each fell to a single unauthenticated request. When the control plane is the target, a backlog sorted by base score sends you to the wrong box, because the number cannot see that ISE gates the whole network or that a stale token is still valid. The ordering that helps is built on your own exposure and on what attackers are doing today, which is the loop our CTEM platform runs with TRIS, and the loop I want this letter to run for you every Monday.

Patch well,
Chris Boker
Founder, CVEasy AI