Daily Cybersecurity Briefing — September 8, 2026

ACTIVELY EXPLOITED VULNERABILITIES

• SAP September 2026 Patch Day — 19 Security Notes including 4 critical flaws: CVE-2026-44756 (CVSS 10.0) memory corruption in SAP Extended Passport (EPP) Processing affecting multiple Kernel/Web Dispatcher releases; CVE-2026-58240 (CVSS 9.8) missing-auth in NetWeaver Message Server; CVE-2026-76969 (CVSS 9.4) credential disclosure in SAP Cloud Application Programming Model; CVE-2026-66768 (CVSS 9.0) improper access control in SAP GUI for Java. Treat CVE-2026-44756 as emergency patching priority. Source: gbhackers.com / securityonline.info

• N-able N-central CVE-2026-86218 (CVSS 10.0) — Maximum-severity RCE vulnerability in the N-central RMM platform. Hotfix 4 (build 2026.3) was shipped September 6. Actively being leveraged to plant backdoors. Patch immediately. Source: cybersecuritynews.com

• CISA KEV Additions (Week of Aug 31–Sept 6) — 10 vulnerabilities confirmed exploited in the wild, including: CVE-2026-83548 / CVE-2026-83549 (SonicWall SMA1000 SSRF & OS Command Injection); CVE-2026-82329 (JFrog Artifactory Improper Authentication); CVE-2026-59822 (BerriAI LiteLLM Improper Authentication); CVE-2026-85046 (Google Chromium V8 Type Confusion, added Sept 4); CVE-2026-81578 / CVE-2026-82078 (PaperCut NG/MF). FCEB agencies must remediate per BOD 22-01 deadlines. Source: cisa.gov / thehackernews.com

• Adobe Commerce Zero-Day & MikroTik RouterOS Bugs — Attackers actively leveraging unpatched Adobe Commerce and new MikroTik RouterOS vulnerabilities to achieve RCE and establish persistent footholds. Source: cybersecuritynews.com

• ConnectWise ScreenConnect — Worm-like file-transfer campaign actively exploiting ScreenConnect installations. Organizations using ConnectWise for remote management should audit for indicators of compromise immediately. Source: xloggs.com

BR3ACHES

• Trezor Hardware Wallet Breach — Trezor reported a breach impacting approximately 81,000 customers. Nature of the compromise involves customer data exposure. Users should be alert for phishing attempts targeting Trezor account holders. Source: cybersecuritynews.com

• NATO Unclassified Documents Leaked — Documents from 2009–2024 were leaked as of early September 2026. The leak involves NATO unclassified records, underscoring ongoing risks from insider threats and archival data exposure. Source: pkware.com / tech.co

• Nightmare Eclipse Campaign — Researchers revealed an active campaign targeting CrowdStrike, Nvidia, and Avast, exploiting trusted security and technology vendor infrastructure as a pivot for lateral movement. Source: xloggs.com

THREATS & POLICY

• CIRCIA Final Rule Expected This Month — CISA is targeting September 2026 to finalize the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule. Will require covered entities to report cyber incidents within 72 hours and ransom payments within 24 hours. Applies across all 16 critical infrastructure sectors. Organizations should begin compliance gap assessments now. Source: hunton.com / federalnewsnetwork.com / cisa.gov

• White House Authorizes Private Sector Offensive Cyber Ops — A White House memo has authorized vetted private sector companies to conduct cyber surveillance and offensive cyber effects operations against foreign Transnational Criminal Organizations (TCOs). Significant policy shift blurring government-private sector lines in offensive cyber. Source: f-secure.com

• TeamPCP Supply Chain Group Arrested — The TeamPCP supply chain threat actor group that operated for over a year has been arrested. Additionally, the Chinese QTFY hacking platform (operating since 2018) was disrupted. Source: f-secure.com / fbi.gov

• F-Secure September 2026 Threat Bulletin — Monthly advisory covering active threat actor campaigns, emerging malware families, and threat intelligence highlights for defenders. Source: f-secure.com

• NIST SP 800-209r1 Public Comment Period Closes Today (Sept 8) — The initial public draft of NIST Special Publication 800-209r1, Security Guidelines for Storage Infrastructure, closes for public comment today. Organizations with storage security programs should check NIST CSRC for updates. Source: csrc.nist.gov

CLOUD & SAAS SECURITY

• Misconfiguration Epidemic — 2026 data shows cloud misconfigurations remain the #1 cloud security risk, responsible for 50%+ of cloud breaches. The average enterprise now runs over 3,000 misconfigured cloud assets at any given time. Gartner still projects 99% of cloud failures through 2026 are customer-caused. Source: deepstrike.io / redsentry.com

• SAP Cloud Integration Suite Vulnerabilities — September 2026 SAP patch batch includes CSRF, SQL injection, SSRF, and authorization flaws in cloud-connected SAP products including Integration Suite and Commerce Cloud. Organizations running SAP in hybrid/cloud configurations should prioritize patching. Source: gbhackers.com / cyberpress.org

• JFrog Artifactory Improper Authentication (CVE-2026-82329) — Added to CISA KEV, indicating active exploitation of the popular DevOps artifact repository. Organizations should audit Artifactory exposure and apply vendor patches immediately. Source: cisa.gov

IDENTITY & AUTHENTICATION

• Microsoft Entra ID Force-Migrates SMS/Voice MFA Users to Passkeys — Starting September 1, 2026, Microsoft is auto-enrolling Entra ID users on SMS/voice MFA for passkeys and nudging registration. Passkeys are now the default sign-in method. Admins should communicate this change and prepare helpdesk for passkey enrollment support. Source: thehackernews.com / mojoauth.com

• New Passkey Attacks Bypass Phishing-Resistant MFA — Three attack techniques disclosed around Black Hat USA 2026 can defeat passkey authentication by reading event logs, scraping memory, and reusing open sessions. Microsoft's July 2026 Windows updates partially mitigate the log-reading vector. Organizations should apply recent Windows updates. Source: thehackernews.com / nexusvoidai.com

• Pass-the-Passkey Attacks on Windows 11 / Microsoft Entra ID — Research confirms Pass-the-Passkey attacks can bypass MFA in Windows 11 and Microsoft Entra environments without breaking WebAuthn cryptography. Device code phishing has surged with 30+ distinct kits now offering the technique. Source: ground.news / menlosecurity.com

• BerriAI LiteLLM Improper Authentication (CVE-2026-59822) — Added to CISA KEV; active exploitation of LiteLLM's authentication controls. Organizations using LiteLLM as an AI gateway should patch immediately and audit API key access logs. Source: cisa.gov

MOBILE SECURITY

• Google to Lock Down Android Sideloading by Late 2026 — Google announced plans to restrict Android app sideloading later this year to combat sideloaded malware, which accounted for 27 million flagged apps in 2025 (up from 13M in 2024). Play Protect changes expected before year-end. Source: northeasttimes.com

• Android Proxy/Relay Node Exploitation — In 2026, attackers are using network-level exploits to convert Android phones into data proxies or relay nodes for botnet operations without user awareness. Devices on Android 12 or older remain at highest risk for RATs, keyloggers, and data-stealers. Source: nokiapoweruser.com

• 34 Active Banking Malware Families Targeting 1,243 Financial Institutions — Mobile banking trojans and spy trojans (24.49% of Android threat categories) continue targeting 90 countries. Financial institutions and their mobile app users remain high-priority targets. Source: quokka.io

ICS/OT/IoT

• CISA Emergency Directive — ICS Critical Infrastructure — CISA issued an emergency directive for organizations operating critical infrastructure relying on specific vulnerable ICS systems, requiring immediate mitigation actions. Critical infrastructure operators should review the directive and confirm compliance timelines. Source: securityboulevard.com / viakoo.com

• Siemens ICS Products — Multiple High-Severity Vulnerabilities — Siemens issued a security advisory covering multiple vulnerabilities in ICS products that could allow remote code execution. Organizations running Siemens SCADA/ICS should apply patches per vendor advisory timelines. Source: industrialcyber.co / forescout.com

• Iranian Hackers Targeting Siemens, Schneider & Rockwell ICS Devices — US government warns of Iranian threat actors actively targeting internet-exposed ICS devices from major vendors including Siemens, Schneider Electric, and Rockwell Automation. Air-gapped and network-segmented configurations are strongly recommended. Source: securityweek.com

• OT-Targeted Ransomware New Variant — A new ransomware variant specifically targeting OT/manufacturing environments has been identified, exploiting legacy system vulnerabilities. 12% of OT devices carry known exploitable vulnerabilities; 7% are linked to ransomware campaigns per Forescout. Source: industrialcyber.co / scworld.com / forescout.com

• IoT Security Regulation Proposed — New regulations aimed at bolstering IoT device security have been proposed, requiring manufacturers to implement stronger authentication and mandatory security update programs for IoT devices used in OT environments. Source: industrialcyber.co

RESEARCH & TOOLS

• OpenAI Expands Daybreak for Frontline Defenders — OpenAI launched Daybreak for Frontline Defenders, a global cybersecurity initiative providing frontier AI capabilities to organizations protecting essential services. Beginning September 1, all Daybreak individual accounts must adopt hardware security keys. Source: openai.com

• Forescout OT/ICS Vulnerability Spike Report — Forescout published findings flagging a significant spike in high-severity OT/ICS flaws, exposing critical visibility gaps in industrial environments. The report underscores the expanding attack surface in manufacturing, utilities, and healthcare OT. Source: industrialcyber.co / forescout.com

• Exploit Time-to-Exploit Now 44 Days — Palo Alto Unit 42 / industry research confirms time-to-exploit has compressed from 700+ days in 2020 to only 44 days in 2025, meaning patch windows are critically short. Organizations must prioritize rapid vulnerability remediation programs. Source: unit42.paloaltonetworks.com / neteye-blog.com

AI SECURITY

• Indirect Prompt Injection Dominant Attack Vector in 2026 — Indirect prompt injection (embedding adversarial instructions in retrieved documents, emails, web pages) has become the dominant AI attack vector. Attackers use it to hijack agentic AI workflows without direct user interaction. Source: sombrainc.com / thehackernews.com

• CVE-2025-53773 (GitHub Copilot RCE via Prompt Injection, CVSS 9.6) — Hidden prompt injection in pull request descriptions enabled remote code execution through GitHub Copilot. A critical reminder that AI coding assistants introduce new attack surfaces in developer pipelines. Source: cycode.com / redfoxsec.com

• RAG Poisoning Emerging Critical Attack Vector — Adversaries are injecting malicious documents into retrieval-augmented generation (RAG) corpora, causing AI models to treat attacker-controlled content as authoritative. Organizations deploying RAG-based AI systems must implement retrieval source validation and anomaly detection. Source: sombrainc.com / llm-security research

• AI Now Automating Full Exploit Lifecycle — AI has transitioned from phishing writing assistant to a fully automated engine capable of discovering vulnerabilities, writing zero-days, generating voice clones, and running post-exploitation loops without human input. 2026 is being called 'the year of AI-assisted attacks.' Source: thehackernews.com / neteye-blog.com

• BerriAI LiteLLM Auth Bypass (CVE-2026-59822) — KEV-listed improper authentication vulnerability in LiteLLM, a popular AI API gateway, is being actively exploited. API key theft and unauthorized access to AI provider backends is the primary risk. Source: cisa.gov

• Sangoma Switchvox SQL Injection (CVE-2026-9586) — Added to CISA KEV. While an AI-adjacent communications platform, this confirms ongoing exploitation of AI-integrated enterprise tools. Organizations should audit all AI/UC integrations for similar injection risks. Source: cisa.gov

Sources

https://gbhackers.com/sap-september-2026-security-update/ | https://securityonline.info/september-2026-sap-security-patch-day/ | https://cyberpress.org/sap-security-patch-day-fixes-19-new-vulnerabilities/ | https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog | https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html | https://thehackernews.com/2026/05/2026-year-of-ai-assisted-attacks.html | https://www.xloggs.com/2026/09/08/weekly-exploit-roundup-2026-09-08/ | https://www.hunton.com/privacy-and-cybersecurity-law-blog/cisa-plans-to-finalize-cyber-incident-reporting-regulations-in-september-2026 | https://federalnewsnetwork.com/cybersecurity/2026/07/circia-other-big-cyber-rules-expected-to-get-finalized-this-fall/ | https://www.f-secure.com/en/partners/insights/f-alert-cyber-threats-bulletin-september-2026 | https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/ | https://csrc.nist.gov/news | https://securityboulevard.com/2026/09/daily-ot-security-news-september-04-2026-2/ | https://industrialcyber.co/reports/hacktivists-and-cybercriminals-expand-attacks-on-ics-ot-and-ai-systems-across-critical-infrastructure/ | https://industrialcyber.co/threats-attacks/forescout-flags-spike-in-high-severity-ot-ics-flaws-exposing-visibility-gaps-that-leave-critical-infrastructure-at-risk/ | https://www.securityweek.com/us-warns-of-iranian-hackers-targeting-siemens-schneider-and-rockwell-ics-devices/ | https://www.forescout.com/blog/ics-cybersecurity-in-2026-vulnerabilities-and-the-path-forward/ | https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html | https://ground.news/article/pass-the-passkey-attacks-expose-windows-11-and-microsoft-entra-id-bypassing-mfa_312821 | https://sombrainc.com/blog/llm-security-risks-2026 | https://cycode.com/blog/ai-security-vulnerabilities/ | https://www.redfoxsec.com/blog/the-biggest-ai-security-vulnerabilities-discovered-in-2026-redfox-cybersecurity | https://www.neteye-blog.com/blog/2026/07/03/the-ai-cyber-attacks-explosion-in-2026-emerging-threats/ | https://northeasttimes.com/2026/07/26/google-plans-to-lock-down-android-app-sideloading-by-late-2026/ | https://www.quokka.io/blog/the-state-of-mobile-app-security-2026-report-findings | https://deepstrike.io/blog/cloud-security-statistics | https://redsentry.com/resources/blog/saas-security-risks-2026-misconfigurations-compliance-gaps-and-data-breach-prevention