Cybersecurity Weekly Roundup: 14-21 September 2026
1. VMware vCenter Vulnerability Now Exploited by Ransomware Groups
Ransomware groups have joined ongoing attacks exploiting a critical vulnerability in VMware vCenter Server. The vulnerability, patched by Broadcom in July, affects the vCenter Syslog server and can allow unauthenticated attackers with network access to execute arbitrary code.
Security researchers previously identified more than 361 compromised IP addresses across 47 countries following exploitation of the vulnerability. CISA has now confirmed that ransomware groups are also exploiting the flaw, increasing the risk to organisations using VMware infrastructure.
CVE ID: CVE-2026-59310 (CVSS 9.8)
Why It Matters: VMware vCenter provides centralised management of virtual infrastructure. Successful exploitation could give attackers a foothold in an organisation's virtual environment and potentially provide access to sensitive systems, workloads and data. Compromise of virtualisation infrastructure is particularly concerning because attackers may use it to disrupt or encrypt multiple systems simultaneously.
Actions: Apply the latest VMware security updates for affected vCenter deployments immediately. Restrict vCenter management interfaces to trusted networks and administrators rather than exposing them directly to the internet. Review vCenter and network logs for unusual authentication, command execution, reverse SSH connections and unexpected outbound traffic. Organisations that may have been compromised should investigate for persistence mechanisms before considering the incident closed.
2. Cisco Identity Services Engine Zero-Day Actively Exploited
Cisco has released security updates for a maximum-severity vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerability allows unauthenticated remote attackers to bypass authentication through a vulnerable API endpoint.
Cisco's Product Security Incident Response Team confirmed that the vulnerability is being actively exploited in the wild. CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalogue.
CVE ID: CVE-2026-76460 (CVSS 10.0)
Why It Matters: Cisco ISE is used to control access to networks, endpoints and users and is commonly deployed as part of Zero Trust architectures. Compromise of the platform could provide attackers with unauthorised access to a security management system responsible for controlling network access across an organisation.
Actions: Upgrade Cisco ISE and ISE-PIC to the appropriate fixed release immediately, as Cisco has confirmed that there are no workarounds. Review access.log files for suspicious or unexpected usernames and authentication activity. Check firewall and network logs for unusual downloads, uploads or connections to suspicious external infrastructure. If compromise is suspected, follow Cisco's guidance to re-image affected nodes and restore them from trusted backups.
3. Cisco Secure Email Gateway Zero-Day Exploited to Execute Commands as Root
Cisco has warned customers about active exploitation of a critical zero-day affecting Cisco Secure Email Gateway appliances. The vulnerability exists in the email parsing functionality of Cisco AsyncOS and can be exploited remotely without authentication by sending a specially crafted email containing malicious SQL statements.
Successful exploitation can allow attackers to execute arbitrary commands with root privileges on the underlying operating system. Cisco has provided indicators of compromise and recommended reviewing mail logs for suspicious SQL statements.
CVE ID: CVE-2026-76461 (CVSS 9.8)
Why It Matters: Secure Email Gateway appliances sit directly in the email security path and process messages from potentially untrusted sources. Successful exploitation could allow attackers to gain root-level access to the appliance, potentially enabling further network reconnaissance, credential theft, persistence or attacks against internal systems.
Actions: Apply Cisco's security updates immediately to affected Secure Email Gateway appliances. Review mail_logs for suspicious SQL statements and unusual email-processing activity. Check firewall and network logs for unexpected connections, downloads and uploads involving external or suspicious IP addresses. Restrict management access to trusted networks and investigate any appliance showing signs of compromise.
4. Google Pixel Zero-Day Actively Exploited in Targeted Attacks
Google has released its September 2026 Pixel security updates addressing 110 vulnerabilities, including a high-severity zero-day that Google says may be under limited, targeted exploitation.
The vulnerability affects the Cellular Modem component and results from an authorisation and protection mechanism failure. Attackers with access to an adjacent network and basic privileges could exploit the flaw to escalate privileges without requiring user interaction.
CVE ID: CVE-2026-58704 (CVSS 8.8)
Why It Matters: Mobile devices are increasingly used to access corporate email, cloud applications, authentication services and sensitive business information. A privilege-escalation vulnerability on an employee's device could potentially allow an attacker to gain additional access and undermine endpoint security controls.
Actions: Ensure supported Google Pixel devices are updated to the 2026-09-05 security patch level. Confirm that mobile-device-management policies require timely security updates on corporate devices. Prioritise devices used to access sensitive corporate, financial, healthcare or administrative systems. Monitor mobile security platforms for unusual privilege escalation, suspicious applications and abnormal network activity.
Key Recommendations
Prioritise actively exploited vulnerabilities: Review exposure to CVE-2026-59310, CVE-2026-76460, CVE-2026-76461 and CVE-2026-58704 and apply the relevant security updates as a priority.
Secure critical management infrastructure: Give particular attention to VMware vCenter and Cisco ISE, as compromise of these platforms could provide attackers with access to broader infrastructure and network controls.
Protect internet-facing security appliances: Review the exposure of Cisco Secure Email Gateway and other externally accessible security infrastructure and restrict management interfaces wherever possible.
Monitor for exploitation: Review logs for suspicious administrator accounts, authentication bypasses, unusual API activity, unexpected outbound connections, command execution and other indicators associated with these vulnerabilities.
Prioritise mobile security: Ensure corporate mobile devices, particularly those used to access sensitive business systems, are receiving current security updates.
Review for signs of compromise after patching: Patching closes the vulnerability but does not necessarily remove persistence established by an attacker. Where exploitation is suspected, perform an investigation for unauthorised accounts, malware, configuration changes and unusual network activity.
Strengthen vulnerability-management processes: Actively exploited vulnerabilities should receive priority over vulnerabilities based solely on CVSS severity, particularly when they affect externally accessible or centrally managed infrastructure.
