Cyber Roundup: Week of September 7

Voici les principales actualités que vous avez manquées la semaine dernière.

1. N-able: CVE-2026-86218 CVSS 10.0 pre-auth RCE in N-central under active exploitation

Le titre : On September 8, 2026, CISA added CVE-2026-86218 to the Known Exploited Vulnerabilities catalog with a three-day federal patching deadline of September 11. The flaw is a static code injection vulnerability in N-able N-central that allows unauthenticated remote code execution against the management console. N-able’s own emergency notice states it has been observed exploited in the wild. Preemptive exposure management firm watchTowr has reproduced the exploit. Huntress is investigating a September 4 compromise of a fully patched N-central production environment.

Ce que nous sommes en train de regarder : N-central is what MSPs use to administer their client environments, and one N-central server typically manages thousands of endpoints across dozens of organizations. Compromise of the management plane produces cascading compromise of everything it manages.

The Shadowserver Foundation counts roughly 1,500 internet-facing N-central instances, concentrated in the United States and Europe. Each one is a potential entry point for an intrusion that reaches every organization the operator manages. N-able’s hosted N-central on Demand instances have been patched automatically. On-premises deployments require manual application of Hotfix 4, build 2026.3.1.14. Customers who installed the earlier Hotfix 3 to remediate two related admin-account creation flaws (CVE-2026-86206 and CVE-2026-86207) are still exposed to this one.

The Kaseya parallel is unavoidable. When the management platform for many networks is compromised, the operational effect is not one incident but many, distributed across whichever clients the affected MSP happened to serve.

La question du RSSI : For any part of your infrastructure managed by an MSP, do you know whether that MSP runs N-central, when they applied Hotfix 4 build 2026.3.1.14, and whether their answer is specific enough to be verifiable?

2. Cisco: Secure FMC CVE-2026-20079 exploited by both a state-sponsored actor and a Qilin affiliate

Le titre : On September 9, 2026, Cisco updated its advisory for CVE-2026-20079 to confirm active exploitation. The flaw is a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center that allows an unauthenticated remote attacker to send crafted HTTP requests and gain root on the underlying operating system. Cisco disclosed the vulnerability in March 2026 with no evidence of exploitation at the time. Its PSIRT became aware of active exploitation in August. CISA added the vulnerability to the KEV catalog the same day, with a federal patching deadline of September 12.

Ce que nous sommes en train de regarder : Cisco Talos has attributed post-exploitation activity to three distinct threat clusters, including a Qilin ransomware affiliate. Cisco’s own SaaS-delivered Security Cloud Control Firewall Management service has already been patched by the vendor, but on-premises customers require manual intervention.

Talos tracks a cluster it designates UAT-12197 that used CVE-2026-20079 to deploy web shells, install a Java Archive-based command executor, and exfiltrate credentials. A separate cluster tracked as UAT-11988, assessed as a Qilin ransomware affiliate, logged into FMC devices using static credentials and used a companion vulnerability (CVE-2026-20316) for reconnaissance and pre-encryption endpoint enumeration.

The six-month gap between disclosure in March and confirmed exploitation in August is the operationally significant fact. Cisco published the patch. Organizations that treated the March advisory as a routine hardening item rather than a critical fix are the ones now in incident response.

La question du RSSI : Your patch management program prioritizes based on evidence of exploitation. When a CVSS 10.0 vulnerability with no reported exploitation sits in your queue for six months, what governance forces a re-review before the exploitation catches up to the risk score?

3. MikroTik: MikroTrick chain gives unauthenticated attackers full RouterOS admin on 122,500 exposed devices

Le titre : On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to the KEV catalog with a federal patching deadline of September 13. CVE-2026-86060 is one half of a chain that CERT Polska has named MikroTrick. Chained with CVE-2026-67276 (an SSH authentication bypass that is not on the KEV catalog), it allows an unauthenticated attacker with network access to a RouterOS device’s SSH service to obtain full administrative control. CVE-2026-67277 is a separate missing-authentication flaw in the RouterOS bandwidth-test service that CERT Polska disclosed at the same time. Exploitation was observed beginning September 2, one day before MikroTik shipped patched builds on September 3.

Ce que nous sommes en train de regarder : The Shadowserver Foundation counted approximately 122,500 RouterOS devices with SSH reachable from the public internet in a single September 5 scan window. Each unpatched exposed device is a candidate for full unauthenticated takeover.

CVE-2026-86060 is a privilege-escalation flaw in the SSH login helper: a specially crafted username that begins with a disallowed character causes RouterOS to apply the full administrator policy mask instead of the restricted session policy that should have resulted. Chained with CVE-2026-67276, which lets an unauthenticated client open an SSH session channel to a RouterOS device without a valid private key, the two together turn network reachability into administrative control without any credential, private key, or prior admin account. CVE-2026-67277, meanwhile, allows kernel memory disclosure and denial-of-service against the bandwidth-test service on TCP port 2000.

CERT Polska disclosed that the bugs were discovered with assistance from AI systems, which shortens the discovery-to-disclosure timeline meaningfully. That helps defenders and attackers equally: reverse engineers reproduced the full chain in approximately three hours using an AI agent working from the public advisory and patch diff.

La question du RSSI : If your organization has any MikroTik hardware at any site, do you have a current inventory of which devices have SSH exposed to the internet, and how quickly can that answer be produced?

4. GitLab: CVE-2026-85706 CVSS 10.0 file read hit indiscriminate probing 20 hours after patch

Le titre : On September 10, 2026, GitLab patched CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in the repository commits API affecting self-managed Community Edition and Enterprise Edition. The flaw combines improper path confinement with missing authentication enforcement. A single crafted HTTP POST to /api/v4/projects/{id}/repository/commits/ allows an unauthenticated attacker to read arbitrary files from the GitLab server, provided the instance hosts at least one public project. CISA added it to the KEV catalog on September 11 with a federal deadline of September 14.

Ce que nous sommes en train de regarder : watchTowr’s honeypot network observed in-the-wild probes at 06:00 UTC on September 11, roughly 20 hours after the patch shipped. GitLab.com is patched. An estimated 20,000-plus self-managed instances remain exposed.

The immediate compromise is arbitrary file read, not code execution, which sounds like the smaller of two evils. The actual impact depends less on the GitLab process itself and more on what is stored on the GitLab server. Configuration files, integration settings, access tokens, deploy keys, and credentials used by connected CI/CD pipelines are all readable by the same account that runs GitLab. In practice, an arbitrary read of a GitLab server frequently produces the credentials required to compromise everything the server integrates with.

This is the second CVSS 10.0 path traversal in GitLab within three years, following CVE-2023-2825 in May 2023. Two maximum-severity path traversals in different API surfaces in three years suggests a structural weakness in how the platform validates untrusted file paths, not a one-off implementation error.

La question du RSSI : If a threat actor read every file your GitLab service can read, how many production systems would that compromise, and how would you know which of those systems had been touched?

5. Proofpoint: BlueMoon exploit kit shared across four espionage clusters in twelve days

Le titre : On September 9, 2026, Proofpoint published Once in a BlueMoon, documenting a previously undocumented exploit kit adopted by four separate espionage clusters between August 28 and September 3. BlueMoon chains three vulnerabilities: CVE-2026-85046 (a Chrome V8 type confusion flaw patched by Google on September 3), CVE-2026-87491 (a Chrome V8 sandbox escape), and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC that enables local privilege escalation to SYSTEM). A single click on a phishing lure produces code execution as SYSTEM on the target’s Windows machine with no further user interaction. CISA added CVE-2026-85880 to the KEV catalog on September 8 and CVE-2026-87491 on September 9.

Ce que nous sommes en train de regarder : Four separate espionage clusters ran distinct lures against different geographies with different payloads. The exploit code they shared was the same. Proofpoint’s own writeup notes that the mechanism by which those clusters obtained access to the same kit is unknown.

The first observed cluster was TA412, also known as APT31, a China-aligned state actor, which targeted US NGOs, mining companies, and commodity traders on August 28 with lures posing as university interns and conference organizers. UNK_LateNight targeted US aerospace organizations. UNK_DoubleCheck ran spear-phishing lures at a Vietnamese manufacturing entity. UNK_QuietRacket targeted government, consulting, and financial-sector organizations in Indonesia and Singapore. Proofpoint assesses the majority of the observed clusters as having a suspected China nexus and notes that some activity remains unattributed.

Both Chrome V8 vulnerabilities were patch-gap zero-days at the time of exploitation. The upstream Chromium fix was public before Chrome Stable had rolled the change to end users, and attackers who reverse-engineered the upstream patch had a working exploit before the browser update reached defenders. The pattern is not new. The speed of adoption across independent clusters is.

La question du RSSI : Your endpoint detection catches known malware payloads and post-exploitation behaviors. Does it also detect the moment an in-browser exploit produces SYSTEM on a corporate device, or does that step remain invisible until the payload it delivers announces itself?

Le schéma commun aux cinq histoires

Every story this week is about a system that manages other systems. N-central manages MSP client endpoints. Cisco Secure FMC manages Cisco firewalls. MikroTik SSH manages the router that manages the network. GitLab manages source code and the secrets that reach every system the code deploys to. BlueMoon does the same job from the other direction, turning the browser into the management plane for whatever session the user was in.

Three of the five stories involve CVSS 10.0 vulnerabilities. The other two use chains of lower-severity flaws that produce the same practical outcome: unauthenticated attackers reaching the console layer without credentials. Attackers this week did not need to compromise many machines. They compromised the one thing that had reach across many. CybelAngel surfaces the exposed management planes, forgotten internet-facing consoles, and leaked credentials that turn each of these stories into a follow-on incident somewhere downstream.