The week’s material risk is not a single CVE. It is the identity and policy control plane. In seven days, CISA confirmed active exploitation against Cisco Identity Services Engine, Check Point VPN and management servers, F5 BIG-IP Access Policy Manager when used as an OAuth authorization server, and Arista’s on-prem VeloCloud Orchestrator. These products issue tokens, enforce network policy, or orchestrate SD-WAN. Compromise is total-control of the access path, not a routine patch-backlog item.
CISA’s Binding Operational Directive 26-04 is now the operating tempo. Remediation due dates clustered on 19, 24, and 25 September. Programs that still treat Known Exploited Vulnerabilities as a fourteen- or thirty-day SLA are out of phase with observed exploit velocity.
Supply-chain impact arrived late. CrowdSec confirmed a May source-code exposure involving its private GitHub repositories. The company said the May TanStack npm compromise was the likely vector. Incomplete credential offboarding converted a short-lived package event into a months-long blast radius. That is the failure Package Firewall, SCA, and token hygiene are built to interrupt.
Ransomware has moved onto the hypervisor and the firewall. CISA flagged ransomware use of VMware vCenter CVE-2026-59310 on 15 September and WatchGuard Firebox CVE-2025-14733 on 9–10 September. Edge access and virtualization management are now the same campaign class.
Identity tokens are a documented control gap. CISA and NIST published Interagency Report 8587 on 15 September. The same window produced exploited OAuth-adjacent appliance flaws. Token lifetime, signing-key hygiene, and revocation are board-level controls. External Attack Surface Management plus Dynamic Analysis is how application programs find the HR, recruiting, and vendor-admin surfaces that sit behind those tokens.
EU product reporting is live. Cyber Resilience Act Article 14 obligations for actively exploited vulnerabilities and severe incidents applied from 11 September 2026—more than a year before full CRA product rules in December 2027. Organizations that ship products with digital elements into the EU now operate on a twenty-four-hour early-warning clock. Policy evidence and SBOM coverage are no longer optional artifacts.
The Past Week in Review
16–23 September 2026
The week compressed into one pattern: unauthenticated or pre-authentication flaws on internet-reachable identity, VPN, and orchestration systems, plus delayed disclosure of a supply-chain exposure that began in May.
Cisco Identity Services Engine, 16 September. Cisco disclosed CVE-2026-76460 after a TAC case. Insufficient authentication on an API endpoint allows an unauthenticated remote attacker to bypass the web management interface. Cisco PSIRT confirmed exploitation. The flaw affects ISE and ISE-PIC releases 3.0 through 3.5 in any configuration. Fixed trains are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Release 3.0 is end of maintenance. There is no functional workaround. Infrastructure ACLs that restrict management-plane reachability are containment only. CISA added the CVE to the KEV catalog the same day, with a 19 September due date. ISE stores policy and identity context for network admission. Root on ISE is lateral movement across every segment the appliance governs. Cisco also patched a second emergency in the same week: CVE-2026-76461 on Secure Email Gateway.
F5 BIG-IP Access Policy Manager, 22 September. CVE-2026-94127 is a heap overflow in the data plane when an APM access policy and an OAuth profile are bound to the same virtual server, specifically when APM is the OAuth authorization server. Unauthenticated traffic can yield remote code execution. Appliance mode is in scope. Deployments that use APM only as an OAuth client or resource server are not. F5 stated exploitation in the advisory. CISA listed it the same day, with a 25 September due date and forensic triage required under BOD 26-04.
Check Point, 22 September. Two KEVs. CVE-2026-85102 is improper certificate validation during VPN negotiation on Security Gateway and Spark Firewall using site-to-site or remote-access VPN. CVSS 9.8. Check Point has said exploitation attempts against Spark customers were observed after the 9 September patch. CVE-2026-93616 is a pre-authentication path traversal on Security Management Server, Multi-Domain Server, Log Server, and SmartEvent that allows unauthenticated script or Java class load. The vendor has said pinpointed use was observed as early as 23 July. LivePatch does not remediate 93616. Restrict TCP/19009 and apply the vendor SK. Due date for both is 25 September.
Arista VeloCloud Orchestrator on-prem, 22 September. CVE-2026-93952 allows remote access to privileged internal functionality on the orchestrator host. Hosted and Dedicated instances were already patched by the vendor. On-prem deployments require the current fixed builds published in Arista’s 22 September advisory. An SD-WAN orchestrator is a fleet-control system. Residual risk after compromise is policy rewrite and edge-device persistence. CISA due date is 25 September.
Linux kernel, 18 September. CISA added three kernel flaws with evidence of active exploitation: CVE-2025-39682 in the TLS receive path, CVE-2026-53266 as an out-of-bounds write in the ebtables SNAT path, and CVE-2025-39964 as a race on AF_ALG sockets. Due date was 21 September. These are local or adjacent privilege and integrity issues. They matter on any internet-exposed Linux estate that has not taken current vendor kernels.
Zyxel GS1900 switches. CVE-2026-7273 is a stack-based buffer overflow in web-management CGI that lets a LAN-adjacent, unauthenticated attacker run OS commands. Zyxel patched in June. Researchers later reported widespread exploitation of unpatched devices, including theft of configurations and credentials, with many systems still on factory defaults. CISA listed the flaw on 21 September with a 24 September due date. These switches sit in branch and mid-market networks—exactly where segmentation assumptions fail.
Supply chain: delayed blast radius, not a new worm this week. On 16–18 September CrowdSec confirmed a source-code exposure that occurred in May. The company’s public statement said private repositories containing SaaS-console code, cloud routines, connectors, and automations were copied; public open-source repositories were out of scope by design. CrowdSec said the May TanStack npm compromise was the likely vector, rotated credentials, and reported no evidence that customer databases were accessed or that code was modified. Press reporting put the private-repository count at about 170. First-principles reading does not depend on the exact count: package-time credential theft plus incomplete token offboarding produced months of dwell. Scanning after merge would not have stopped the copy. A registry-level block of the malicious versions, plus same-day revocation of the token, would have. That is Package Firewall plus offboarding discipline, not another ticket in the SCA queue.
FortiBleed is not a new week incident. Later reporting has tied previously harvested FortiGate credentials to follow-on ransomware use. Treat it as compounding residual risk from earlier in the year: reset VPN and admin credentials, enforce phishing-resistant MFA, and remove management interfaces from the public internet.
Governance signal in the same window. CISA and NIST released IR 8587 on 15 September, Protecting Tokens and Assertions from Forgery, Theft, and Misuse. It operationalizes token issuance, verification, key protection, lifetime, and revocation. It is the correct control language for this week’s OAuth-adjacent appliance flaws.
Application-surface signal. Internet-facing HR, recruiting, and vendor-administration portals remain a high-value, under-tested class. Leading programs do not wait for a named incident. They use Veracode EASM to find those hosts and Veracode DAST to test them.
Next action for the week. Before opening a new program, inventory internet-reachable ISE, F5 virtual servers with APM plus OAuth, Check Point management listeners, and on-prem VeloCloud UIs. Patch or network-restrict inside the BOD 26-04 window. Hunt logs for anomalous API usernames on ISE, OAuth failures followed by TMM abort on F5, and unexpected management-web activity on Check Point. Then use Veracode EASM to confirm which of those management and application surfaces are still reachable from the internet.
The Past Month: Trends and Persistent Risks
24 August–23 September 2026
What accelerated.
Edge and management-plane exploitation. The September week was the peak, not the start. Earlier in the month CISA listed Cisco Secure Firewall Management Center CVE-2026-20079, an authentication bypass with CVSS 10.0; Citrix NetScaler CVE-2026-19490; and Fortinet CVE-2025-25249, with a 12 September deadline. The month’s velocity is unauthenticated remote code execution on the box that issues tokens or pushes policy.
Ransomware on the virtualization and firewall layer also accelerated. On 15 September CISA updated KEV language to record ransomware use of VMware vCenter CVE-2026-59310, a syslog directory traversal that yields unauthenticated remote code execution. Broadcom patched it on 29 July. CISA listed it on 18 August. On 9–10 September CISA separately recorded ransomware use of WatchGuard Firebox CVE-2025-14733. Public scanning has continued to show a long tail of unpatched appliances months after the original patch. Residual risk is hypervisor-management ownership and delayed edge remediation.
The AI and artifact-repository stack entered the KEV catalog. Early September additions included LiteLLM CVE-2026-59822, a Starlette/FastAPI host-header bypass CVE-2026-48710, JFrog Artifactory default-configuration admin-token minting CVE-2026-82329, and Kestra OSS authentication bypass CVE-2026-49869. Treat AI toolchains as production identity systems and put them behind Package Firewall, SCA, and container scanning the same way as any other build path.
Supply-chain dwell time compounded. TanStack in May to CrowdSec disclosure in September is the object lesson. Complementary signals in the same thirty days included exploitation of self-hosted artifact repositories and a public infrastructure-module registry window. Detection after merge is late. Prevention at ingest is the control. That is why leading Veracode programs put Package Firewall in front of npm, PyPI, Maven, and Terraform registries rather than waiting for a finding in production.
Browser and endpoint exploit kits continued to circulate. Residual application risk is the internal web application that becomes second-stage after an endpoint is owned—precisely the surface Static Analysis, DAST, and EASM are meant to shrink.
What stabilized, still high.
Ransomware volume against manufacturing and other critical sectors remains elevated. Joint public advisories restated in August that the Medusa operation has affected more than 500 organizations across multiple critical sectors since 2021. Attribution of individual groups fluctuates. Initial access via unpatched edge and stolen VPN credentials does not.
SEC Item 1.05 four-business-day materiality reporting remains in force. Item 8.01 voluntary filings continue to outpace 1.05. No new enforcement spike this week. Process discipline is the requirement. Risk Manager and policy evidence are how application programs show the board what closed, what remains, and who owns it.
What is emerging or compounding.
EU product and AI clocks tightened. CRA Article 14 reporting applied from 11 September 2026 for actively exploited vulnerabilities and severe incidents. Full CRA product obligations remain December 2027. The EU AI Act’s general application date was 2 August 2026. NIS2 transposition pressure continues. One incident can now trigger NIS2, GDPR, DORA, and CRA clocks at the same time. Continuous SBOM generation and policy-aligned scan evidence are the application-security contribution to that reporting pack.
Industrial-scale model distillation became a named competitive-intelligence issue. On 8 September a joint U.S. advisory described large-scale extraction of capabilities from U.S. frontier models since at least late 2024. That is intellectual-property and terms-of-service abuse at industrial scale, not a CVE. For CISOs it is API-key governance, anomalous token-volume detection, and contractual use constraints on model endpoints. The adjacent application risk is the AI toolchain itself: treat those packages, images, and gateways as in-scope for SCA, Package Firewall, and Container Security.
Identity federation and session replay persisted. Month-window reporting included partner-SSO abuse, cloud-console password spraying, and infostealer dumps containing live AI-platform session tokens. Combined with IR 8587, the month’s identity lesson is that SSO, OAuth, and long-lived API tokens are the perimeter. Container Security secret scanning and EASM discovery of forgotten admin hosts reduce the application share of that exposure.
CIRCIA status as of this morning: the final rule had not been published in the Federal Register. Do not treat seventy-two-hour incident or twenty-four-hour ransom-payment clocks as enacted this week. Prepare playbooks. Do not report the rule as live.
Strategic Foresight: Next 30–90 Days
Grounded only in what is already listed, patched, or published.
High confidence. More control-plane KEVs will arrive with three-day clocks. BOD 26-04 tiers remediation by exploitation evidence and total-control impact. The last thirty days produced that profile repeatedly. Pre-stage change windows and forensic-triage playbooks for identity, VPN, SD-WAN, and virtualization management products. Use EASM to keep the internet-reachable set honest.
High confidence. Package malware will keep bypassing install-hook controls. Runtime loaders, cache-poisoned CI publish paths, and registry-window substitution are independent techniques in the same quarter. Registry-level policy enforcement—Veracode Package Firewall—is the control that sits before developer machines and CI runners.
Medium-high confidence. Enterprise HR, recruiting, and vendor-administration applications remain a preferred commercial target class. The pattern is consistent: an internet portal, an identity store, a cloud pivot. EASM discovery plus DAST of unmanaged recruiting and vendor-admin surfaces is a thirty-day control, not a 2027 roadmap item.
Medium confidence. CIRCIA lands in the fourth quarter if not this month. Prepare evidence quality, third-party notification trees, and ransom-payment decision rights now. Do not staff as if the rule is already binding. Risk Manager ownership and policy history are the application evidence layer that briefing will need.
Medium confidence. AI coding agents and model-gateway flaws become a named residual-risk item at the board. Developer workstations hold cloud, source-control, and model-provider credentials. A poisoned package or a gateway authentication bypass converts an application finding into an identity incident. Put that toolchain on the same Veracode path as any other production service: Package Firewall, SCA, Container Security, and Fix.
Do not attribute the F5, Arista, or Check Point exploitation beyond vendor- and CISA-confirmed active use. Attribution is not required to prioritize the patch.
Veracode Recommendations: How Leading Programs Are Responding
Stop malicious and policy-violating packages at ingest with Package Firewall, SCA, and Software Supply Chain Intelligence. This maps to the TanStack delayed blast radius, runtime package loaders, registry substitution, and AI-toolchain dependency risk. Point package managers—or artifact-repository remotes—at Package Firewall. Enable pre-built malware, typosquat, and vulnerability policies. Add a deny for High and Critical. Run SCA agent scans on every build and generate SBOMs in the same job. Use Software Supply Chain Intelligence where a malware or reputation feed is required.
Working references: Package Firewall, package-manager integration, artifact-repository integration, firewall policies, SCA agent scans, SBOM creation, and Software Supply Chain Intelligence.
Expected outcome: non-compliant packages blocked before merge; measurable time from malicious-version publish to deny; SBOM coverage of production repositories.
Scan containers, IaC, and secrets in the same pipeline with Container Security and the CLI. This maps to malicious infrastructure modules, images used by model-serving stacks, and tokens embedded in templates. Add CLI container and IaC scans on every repository that ships Dockerfiles, Helm, Terraform, or cloud templates. Fail the pipeline on embedded secrets and policy-violating base images.
Working references: Container Security, install the CLI, CLI, and Integrations.
Expected outcome: production images and IaC repositories scanned per release; secrets closed before deploy; SBOM attached to every release artifact.
Discover the internet surface that is not in the application inventory with EASM and DAST. This maps to HR and recruiting portals, commerce storefronts, unmanaged APIs, and internet-facing management UIs that application security does not own. Run EASM Deep Discovery against primary domains. Enroll discovered applications as DAST candidates. Prioritize authentication bypass, injection, and exposed admin consoles.
Working references: attack-surface discovery, EASM quickstart, and DAST for web applications and APIs.
Expected outcome: count of previously unknown internet applications; time from discovery to first dynamic scan; coverage of HR, vendor-admin, and commerce hosts.
Cut first-party time-to-fix with Static Analysis, Fix, Pipeline Scan, and the CLI. This maps to injection and memory-safety flaws that become ransomware and worm payloads once the edge is owned. Gate CI on Pipeline Scan or CLI static results against policy. Enable Fix in the IDE and CLI for SAST. Use Fix for SCA in remote or source-control mode where licensed—Limited Availability as of 8 September 2026. Rebuild and rescan. Do not treat generated patches as applied until the subsequent scan is clean.
Working references: Static Analysis, Fix, Fix for SCA, Fix in development workflows, and Pipeline Scan.
Expected outcome: shorter time to remediate policy-failing High and Very High findings; higher policy-pass rate on release branches.
Show the board residual risk, not ticket volume, with Risk Manager and Policies. September’s CVE volume plus same-week edge zero-days will drown a queue that is not correlated. Ingest static, composition, dynamic, container, and connected repository findings into Risk Manager. Score by asset criticality and exploitability. Align application policies and Package Firewall policies to the same severity language. Report two numbers: KEV-class internet-exposed closure time, and policy-noncompliant business-critical applications.
Working references: Risk Manager, VRM getting started, and policies and analytics.
Expected outcome: time-to-next-action on correlated issues; trend of policy-failing Tier-0 applications.
What CISOs Should Do Now
Next 24 hours. Inventory and either patch or network-restrict Cisco ISE and ISE-PIC; F5 virtual servers with APM and an OAuth authorization-server profile; Check Point VPN gateways and management listeners; on-prem Arista VeloCloud Orchestrator UIs; VMware vCenter builds before the July CVE-2026-59310 fixes; Zyxel GS1900 on pre-June firmware; and WatchGuard Firebox still on vulnerable Fireware. Complete forensic triage on any of those assets that were internet-reachable before the patch. Confirm the same hosts in Veracode EASM so application owners and infrastructure owners are looking at one list. Done when a named owner, a build or hotfix version, and a hunt result exist for each product.
Next 72 hours. Place Veracode Package Firewall in front of npm, PyPI, Maven, and registry paths used by developers and AI coding agents. Revoke source-control, package-registry, and cloud tokens belonging to departed users and to any workstation that installed untrusted packages since May. Treat a token left live after departure as an incident class. Done when new package versions cannot reach CI without policy evaluation, and stale OAuth tokens are dead.
Next 7 days. Run EASM Deep Discovery. Dynamically test every discovered HR, recruiting, commerce, vendor-admin, and API host in Veracode DAST. Align CRA Article 14 reporting contacts if the organization ships products with digital elements into the EU. Done when previously unknown internet applications have an owner and a first dynamic scan.
Next 30 days. Stand up Risk Manager as the portfolio view. Turn on Fix for SAST in the IDE and CLI, and Fix for SCA where licensed. Scan containers and IaC in the same pipeline as static and composition analysis. Implement IR 8587 token lifetime and signing-key rotation on the enterprise identity provider. Write the dual-hat NIS2, GDPR, and CRA notification tree, and draft CIRCIA playbooks even though CIRCIA is not yet a final rule. Done when the board pack shows KEV internet-exposed closure time, Package Firewall block rate, and the policy-failing Tier-0 application trend—not scanner ticket count.
Board metric for the quarter. Percentage of internet-exposed, total-control KEVs closed inside three calendar days, with forensic triage recorded—paired with Package Firewall block rate and EASM-to-DAST coverage of newly discovered hosts. Those three numbers track this month’s attacker tempo and show that the Veracode program is closing the software and supply-chain share of the same risk.
The residual risk that remains after this sequence is identity-token theft, unpatched management planes outside the inventoried set, and third-party applications whose OAuth scopes the enterprise does not control. Those are design problems. They are not solved by adding another scan. They are solved by shortening token life, removing management interfaces from the public internet, and using Veracode Package Firewall, SCA, EASM, DAST, Container Security, Fix, and Risk Manager so bad packages and unknown applications never become the next months-long disclosure.
Execute the inventory first. Measure closure time. Expand Veracode coverage only after the control plane is no longer an open door.
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.
