Wednesday, September 23, 2026
Daily digest
Heavy day for actively-exploited zero-days: F5 BIG-IP APM, Arista VeloCloud Orchestrator, Check Point Management Server, and a Chrome-Windows exploit chain were all disclosed or patched in the last 24 hours — patch triage should be top priority.
F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers
F5 disclosed CVE-2026-94127, a critical flaw in BIG-IP Access Policy Manager that lets attackers run code without authentication when APM acts as an OAuth authorization server. F5 released engineering hotfixes on September 22 after confirming active exploitation.
Why it matters: If BIG-IP APM is used anywhere in the environment as an OAuth token issuer, apply the hotfix immediately — unauthenticated RCE on an access management appliance is a direct path to lateral movement into CUI-bearing systems.
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
Threat actor UTA0565 was observed on September 3-4 chaining two Chrome zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC vulnerability (CVE-2026-85880) via fake websites to deploy CLEANGULP malware. All three flaws have since been disclosed publicly.
Why it matters: Confirm Chrome and Windows patch levels across the Intune-managed fleet cover these CVEs — browser-to-kernel exploit chains bypass most endpoint hardening short of full patching.
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
The ShinyHunters extortion group defaced the FBIjobs.gov site and claims to have stolen sensitive data on FBI agents and job applicants. The FBI is investigating; the group replaced site imagery with its mascot and stated the breach was not financially motivated.
Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Arista Networks released patches for a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that is being actively exploited in the wild. Details on the specific attack vector were not disclosed.
Why it matters: SD-WAN orchestrators are high-value targets for network-wide compromise; if VCO On-Prem is in use, patch immediately and check orchestrator logs for signs of prior exploitation.
Microsoft: September Windows Updates Break Always On VPN Connections
Microsoft confirmed that the September 2026 Windows security updates are breaking Always On VPN connections on some Windows 11 systems. A fix has not yet been released; Microsoft is investigating workarounds.
Why it matters: Test this month's patch Tuesday updates against Always On VPN before broad Intune deployment — remote workers losing VPN connectivity could disrupt access to CUI systems.
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape
A use-after-free bug in the Linux kernel's AF_UNIX socket subsystem (CVE-2026-80521, CVSS 7.8) can be exploited to escape a container and gain root on the host. The flaw was fixed upstream on August 6, but Ubuntu has not yet shipped the patch for 26.04, 24.04, or 22.04 LTS, and a public exploit is now available.
Why it matters: Any containerized workloads running on Ubuntu-based VMs under Nutanix AHV are exposed until Canonical ships the backport — track this CVE and consider interim mitigations like seccomp/AppArmor restrictions on AF_UNIX.
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Check Point disclosed CVE-2026-93616, a flaw in its Security Management Server that let attackers run scripts without authentication in targeted attacks detected July 23. A fix was released September 22 for the server that controls firewall policies.
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft, with a US federal court order, seized 50 websites and disabled over 150 domains used by the EvilTokens device-code phishing platform, which used AI throughout its attack chain and compromised roughly 12,000 mailboxes. The takedown involved Health-ISAC, Cloudflare, Coinbase, OpenAI, and other partners.
Why it matters: Device-code phishing specifically targets Microsoft 365 authentication flows — verify Conditional Access policies block or restrict device-code auth in the GCC High tenant.
Navigating the Hidden False Claims Act Trap in CMMC Self-Attestation
A CMMC compliance commentary warns that contractors submitting self-attestations of NIST 800-171 compliance face False Claims Act exposure if attestations later prove inaccurate. The piece outlines steps vendors should take to document and validate compliance claims before attesting.
Why it matters: Any Level 2 self-attestation this org submits should be backed by a defensible, evidenced SSP and POA&M — inaccurate attestations now carry legal liability beyond losing a contract.
Preparing for the FBI's 2027 CJIS Security Policy Deadline Starts Now
A commentary piece outlines upcoming changes to the FBI's CJIS Security Policy ahead of a 2027 compliance deadline, urging organizations handling criminal justice information to begin gap assessments now.
Why it matters: If this environment touches CJI in addition to CUI, CJIS policy updates may introduce new technical controls beyond current CMMC L2/NIST 800-171 baseline — worth a gap review this quarter.
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
A critical vulnerability (CVE-2026-90898, CVSS 9.8) in the open-source Bifrost AI gateway allows unauthenticated attackers to run arbitrary commands on the gateway server with a single HTTP request. The flaw affects all versions before 2.1.0 when management authentication is not enabled.
Why it matters: If Bifrost or similar LLM-routing gateways are part of the self-hosted AI stack, confirm management authentication is enabled and patch to 2.1.0+ immediately — this is a trivial unauthenticated RCE.
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A proof-of-concept tool called BigDiskBuster, published on GitHub September 19, can stop Microsoft Defender from installing platform and signature updates by filling all available disk space. There is no patch, CVE, or Microsoft advisory for the issue.
Why it matters: Since this degrades Defender silently rather than disabling it outright, standard AV-health dashboards may not flag it — consider monitoring free disk space and Defender update timestamps as a compensating control on Intune-managed endpoints.