The Daily CVE Update

In today’s episode of The Daily CVE Update, hosted by Corrine, we delve into two critical cybersecurity vulnerabilities that demand immediate attention from UK small businesses. The first, CVE-2026-7273, affects Zyxel GS1900 switches and poses a significant risk due to a stack-based buffer overflow. Unauthenticated attackers could exploit this to execute OS commands, potentially compromising entire network systems. Zyxel and CISA have provided mitigation guidelines that businesses should follow without delay. The second vulnerability, CVE-2026-94493, has a severe CVSS score of ten and affects Gigatech PDV5701 devices. With no vendor response or fix available, businesses are advised to halt use of these devices until the issue is resolved. The episode highlights the need for proactively managing cybersecurity risks, stressing the importance of aligning with CISA directives and engaging vendors for better accountability. By taking these steps, businesses can not only mitigate threats but also differentiate themselves in a competitive market by demonstrating their commitment to cybersecurity.

Five CVSS 10.0 vulnerabilities have been published against networking equipment commonly found in UK small business offices, with public exploits requiring no authentication. Corrine examines the command injection and buffer overflow flaws affecting Netcore NBR200V2 and D-Link DIR-868L routers, explaining how attackers can achieve full network control through diagnostic endpoints, traceroute functions, and even login pages. The episode also dissects the CrowdSec breach, where 170 private GitHub repositories were copied using a former employee’s unrevoked credentials, and explores why offboarding failures remain a persistent regulatory concern for small businesses. Practical guidance includes identifying boundary devices, applying patches, restricting management interfaces, auditing former employee access across all systems, and holding managed service providers accountable for patch status and access revocation. The episode positions router security and offboarding processes as immediate compliance requirements under Cyber Essentials, not theoretical risks.

Two maximum-severity vulnerabilities have emerged within hours of each other, both scoring CVSS 10.0. CVE-2026-76460, an authentication bypass flaw in Cisco Identity Services Engine, is confirmed by CISA as actively exploited in the wild. The vulnerability allows attackers to bypass network access controls entirely, with no credentials required. A second Cisco flaw, CVE-2026-76461 affecting Secure Email Gateway, has also entered CISA’s known exploited vulnerabilities catalogue. Simultaneously, Microsoft disclosed seven CVSS 10.0 vulnerabilities across Azure infrastructure, including Azure Arc, Logic Apps, AI Foundry, Billing, Fabric, and Container Registry. Whilst active exploitation of the Azure flaws remains unconfirmed, the severity ratings reflect maximum impact and exploitability without authentication. UK small businesses face exposure through three vectors: managed service provider dependencies, supply chain relationships, and cloud infrastructure reliance. The episode provides five specific actions to complete before week’s end, including contacting MSPs for written confirmation of patch status, checking Microsoft 365 service health dashboards, and documenting all due diligence steps for ICO accountability and cyber insurance purposes.

Three vulnerabilities have landed on CISA’s Known Exploited Vulnerabilities catalogue overnight, and two of them sit in systems most small businesses never think about but rely on entirely. CVE-2026-87886 affects Acronis Backup software widely deployed in managed hosting environments. CVE-2026-76460 is a perfect-10 authentication bypass in Cisco’s Identity Services Engine, the network access control system that decides who gets onto your network. CVE-2026-58704 targets Google Pixel devices. All three are confirmed under active exploitation. This episode walks through what each vulnerability means in practical terms, why backup and network access control are central to ransomware defence, and what questions to put to your MSP today. We also cover Cisco’s wider release of more than twenty critical CVEs published in a single day, including multiple routes to full system compromise in firewall and network management infrastructure. For UK small businesses, the direct technical exposure may be limited, but the supply chain risk through managed service providers is not. This is about accountability, not alarm. If your MSP manages these systems on your behalf and hasn’t called you yet, this episode explains what to ask and why the answer matters.

Three active exploitation campaigns landed on 16 September 2026, and every single one targeted vulnerabilities with available patches. Corrine walks through the WooCommerce Wholesale Lead Capture plugin flaw (CVE-2026-27540) enabling unauthenticated file uploads, the eight-second lateral movement documented in a Marimo notebook exploit (CVE-2026-39987), and the SQL injection vulnerability in Cisco Secure Email Gateway (CVE-2026-76461) now confirmed under active attack. This episode focuses on the operational gap between patch availability and patch application, which has become the primary risk vector for UK small businesses. No sophisticated tooling required, no zero-days involved, just known flaws in e-commerce platforms, development environments, and email security appliances being exploited at scale. Corrine provides specific, actionable steps for WooCommerce operators, questions to ask MSPs about network segmentation, and concrete guidance for businesses using managed email security services. The thread connecting all three stories is documented proof that the time window between initial compromise and lateral movement has collapsed to seconds, not hours, making pre-incident preparation and patch discipline the only reliable defensive posture.

On 14 September 2026, CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of a critical SQL injection flaw in Cisco Secure Email Gateway. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges. Dark Reading reported that Russian threat actor Sandworm is chaining Cisco vulnerabilities to deploy Cyclops Blink malware, a sophisticated implant that harvests credentials and maintains persistent access. The same day, D-Link disclosed critical buffer overflow and command injection vulnerabilities in three router models (DIR-823G, DIR-878, DWR-M921), scoring up to 9.9 on CVSS, with public exploit code already available. Most UK small businesses do not operate their own email filtering infrastructure but rely on managed service providers whose patch status directly affects their risk exposure. Similarly, consumer-grade routers are frequently deployed and forgotten, with no active firmware management process. This episode provides specific mitigation steps: confirming patch status with MSPs, auditing router inventory, restricting management interfaces to local networks, and establishing defined response times for CISA KEV items in service agreements.

This episode examines ten newly disclosed and actively exploited vulnerabilities affecting router and remote access infrastructure commonly deployed in UK small business networks. Host Corrine Jefferson walks through six CVEs added to CISA’s Known Exploited Vulnerabilities catalogue between 10 and 11 September 2026, including critical flaws in ConnectWise ScreenConnect and MikroTik RouterOS, plus four new critical-severity Totolink router vulnerabilities published to the NIST National Vulnerability Database. The episode explains supply chain risk through managed service provider remote access tools, the specific threat posed by compromised network perimeter devices, and provides five actionable steps businesses can take before week’s end. Corrine offers practical guidance on holding IT providers accountable, understanding buffer overflow exploits, and building a documented patch verification process. The briefing is aimed at business owners and decision-makers who need to understand why infrastructure vulnerabilities demand immediate attention, particularly when public exploit code is already circulating.

This episode examines two critical threats affecting UK small businesses: a Russian-speaking actor’s deployment of AI agents that compromised 440 PaperCut print management servers across 48 countries in 48 hours, and CISA’s addition of two actively exploited MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalogue. Corrine explains how industrialised exploitation through AI automation has collapsed the window between vulnerability disclosure and mass compromise, why background infrastructure like print management software and networking hardware attracts attackers precisely because organisations overlook it, and what specific actions businesses must take within 72 hours. The episode provides concrete guidance on asset identification, patch prioritisation, and vendor accountability, with particular focus on CVE-2026-82078, CVE-2026-81578, CVE-2026-86060, and CVE-2026-67277. This is not theoretical risk assessment; this is operational intelligence from confirmed active exploitation in September 2026.

In today’s episode of The Daily CVE Update, Corrine delves into two critical cybersecurity vulnerabilities impacting small businesses. With a focus on the recent authentication bypass flaw in Citrix NetScaler (CVE-2026-19490) and a critical exploit in Google Chrome’s V8 JavaScript engine (CVE-2026-87491), listeners are given essential information on how to safeguard their digital environments. Corrine highlights the necessity of immediate patching, robust network monitoring, and employee education. She also explains how proactive cybersecurity measures can serve as a competitive advantage and bolster trust with clients. Join Corrine as she explores these pressing issues and provides actionable recommendations to enhance digital security.

In this episode of The Daily CVE Update, host Corrine highlights critical vulnerabilities in Adobe Commerce, Magento, and Microsoft Windows. Small businesses are particularly at risk from CVE-2026-75650, an exploit in Adobe’s systems that allows dangerous code execution, as well as CVE-2026-81963 and CVE-2026-85880 in Microsoft’s software, which facilitate privilege escalation attacks. Corrine stresses the immediate need for applying patches and the significant business risks of inaction. This episode offers actionable advice to turn these security challenges into a competitive edge by enhancing cybersecurity measures and building customer trust.