CYBER THREATCAST

Update supported Google Pixel phones to patch level 2026-09-05 or later immediately. Attackers are exploiting CVE-2026-58704, a high-severity zero-click modem vulnerability, in limited targeted attacks; CISA added it to its Known Exploited Vulnerabilities catalog and set a September 19 remediation deadline.

Apply Cisco’s fixes for CVE-2026-76460 to Identity Services Engine and ISE-PIC without delay. Attackers are actively exploiting this CVSS 10.0 authentication bypass, which can lead to root-level command execution; CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch.

Patch ConnectWise ScreenConnect for CVE-2026-84869 immediately and conduct forensic triage as CISA requires. Active exploitation of this critical authorization flaw can enable unauthorized file transfer and execution, making exposed ScreenConnect deployments a priority for remediation and investigation.

Remediate CVE-2026-76461 on Cisco Secure Email Gateway and affected AsyncOS systems immediately. An unauthenticated crafted email can trigger SQL execution and commands with root privileges; the CVSS 9.8 flaw is actively exploited, and CISA set a September 17 remediation deadline after adding it to its Known Exploited Vulnerabilities catalog.

Prioritize Oracle’s September 2026 security updates across Java SE, Oracle Database, E-Business Suite, Fusion Middleware, Oracle Virtualization, PeopleSoft and Siebel CRM. The update reportedly contains 673 patches covering more than 800 vulnerabilities, including 104 critical flaws, at least one exploited vulnerability and seven with public proof-of-concept code.