Saturday, September 19, 2026|Issue 1|5 min read

Three Linux kernel bugs land on KEV with a three-day fuse

CISA's newest additions give federal defenders until Monday, Check Point patches a root-level management flaw, and ransomware crews keep finding new ways to live off the land.

The short version

CISA added three actively exploited Linux kernel CVEs to KEV on September 18, with a September 21 federal due date.
Check Point patched a critical, unauthenticated root-RCE flaw in Security Management Server, Log Server, and Multi-Domain deployments.
Settra ransomware used MeshAgent for persistence in a July retail attack and a vulnerable driver (BYOVD) to blind security tools in a September manufacturing hit.
BOD 26-04's forensic triage clock is now the operative reality for FCEB shops racing the Linux kernel deadline.

Patch clock

Added 2026-09-18Due 2026-09-21

Today marker at day 1 of 32 days left on the federal deadline

CVE	Product	What it is	Severity
CVE-2025-39682	Linux Kernel	Improper check in the kernel TLS (kTLS) receive path; memory disclosure or DoS. Exposure depends on whether applications use kTLS.	critical
CVE-2026-53266	Linux Kernel	Out-of-bounds write in ebtables SNAT ARP rewrite path, can enable local privilege escalation	high
CVE-2025-39964	Linux Kernel	Race condition in AF_ALG concurrent socket writes, crash or crypto data corruption	high

Also on the vulnerability desk

September 16: Cisco Identity Services Engine incorrect-use-of-privileged-APIs flaw and an Acronis Backup default-permissions bug added to KEV.
CISA
September 9: Fortinet heap overflow, Citrix NetScaler auth bypass, Chromium V8 out-of-bounds write, and a Cisco Firewall Management Center auth-bypass flaw added.
CISA
September 12: five actively exploited flaws in JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS (the 'MikroTrick' chain) were added; Artifactory fixes are due September 25.
The Hacker News

CISA - one vulnerability, Sept 18|CISA - two vulnerabilities, Sept 18|The Hacker News

Breaking

Critical

kev / linux / vulnerability

CISA flags three Linux kernel flaws as actively exploited

CISA added CVE-2025-39682 (kTLS receive path, CVSS 9.8), CVE-2026-53266 (ebtables SNAT out-of-bounds write, CVSS 8.8), and CVE-2025-39964 (AF_ALG race condition, CVSS 7.8) to KEV on September 18.

Why it matters. Nobody has said publicly how the three bugs are being exploited or whether they are chained. Prioritize the kTLS bug on internet-facing servers, but only where applications actually use kernel TLS. Sources disagree on reachability: the Linux kernel project scores it as a network attack needing no privileges, while The Hacker News describes it as local.

What to do. Apply your distribution's kernel update and reboot into it. Upstream fix versions differ per CVE: CVE-2025-39682 is fixed in 6.1.149, 6.6.103, 6.12.44, 6.16.4 and 6.17; CVE-2025-39964 needs 6.1.154, 6.6.108, 6.12.49, 6.16.9 or 6.17, plus 5.10.245 and 5.15.194 on older branches. Distributions backport fixes, so check your vendor's advisory rather than uname -r. If you can't reboot yet, live patching (kpatch, Canonical Livepatch) can close the gap; blocking the af_alg module and dropping ebtables ARP rewrite rules are fallback mitigations.

CVE-2025-39682, CVE-2026-53266, CVE-2025-39964

The Hacker News|windowsforum.com

High

vulnerability / network security / patch

Check Point patches unauthenticated root RCE in management servers

Check Point fixed CVE-2026-91843, a critical stack-based buffer overflow (CVSS 9.8) in the pre-authentication login process of Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server, triggered by an oversized username.

Why it matters. The flaw sits in the pre-authentication login path of the server that controls firewall policy. Check Point says the vulnerable path runs only through the Trusted Clients setting, so management servers that accept connections from any IP are the most exposed.

What to do. Confirm automatic updates or apply the LivePatch fix in advisory sk1000155 immediately; if you cannot patch, restrict the Trusted Clients setting and lock down management access to known hosts.

CVE-2026-91843

The Hacker News|BleepingComputer

Notable

ransomware / malware

Settra ransomware adds BYOVD to its playbook

Huntress documented two Settra intrusions: a July attack on a consumer services and retail firm, where a renamed MeshAgent provided persistence, and a September attack on a manufacturer, where the operators used a vulnerable driver (BYOVD) to impair security tools. Both ended with log clearing and recovery tampering before encryption.

Why it matters. Huntress characterized the operators as competent rather than novel, relying on established ransomware tradecraft instead of new exploits, so basic hardening stops most of it.

What to do. Hunt for unexpected MeshAgent installs, unsigned or unusual kernel drivers, cleared Windows Event Logs, and disabled Windows Recovery Environment as an incident trigger, not a routine finding.

Cybersecurity Dive|GBHackers

Trends

Agentic AI ransomware is a real, narrow category now, not hype

Sysdig's JadePuffer research remains the clearest documented case of an AI agent running an attack from reconnaissance through encryption with little human direction. Its July follow-up, the ENCFORGE locker, targets roughly 180 file extensions across AI and ML environments, including model checkpoints, vector databases and training data, so add those to backup and immutable-storage scope. It's still a handful of observed cases, not a trend line, but it shows how much faster known vulnerabilities and sloppy credential handling get exploited once an agent can test and retry at machine speed.

Sysdig|Cloud Security Alliance

BOD 26-04's forensic triage clock is now live pressure, not paperwork

Under BOD 26-04, a vulnerability that is in KEV and yields total system control on a publicly exposed asset must be fixed within three days, and agencies must also perform forensic triage to determine whether affected systems may have already been compromised. Tenable's own assessment finds 83% of actively exploited CVEs yield total system control, meaning the three-day-plus-triage tier is becoming the routine case rather than an edge case for FCEB teams.

Nucleus Security|Tenable

Ransomware crews keep walking in through exposed enterprise apps

BI.ZONE tracked Feral Wolf from May through August 2026 breaking into Russian organizations in retail, construction, manufacturing and IT through exposed Atlassian Confluence servers (CVE-2023-22515) and poorly configured 1C:Enterprise clusters, then deploying GenieLocker ransomware. Inside, the group relied on GSocket and its own Rust backdoors rather than commercial remote-management tools, and moved from a Confluence container to the Docker host using a weak PostgreSQL password. The lesson travels: patch internet-facing Confluence, keep admin services off the internet, and hunt for unexpected tunneling tools.

GBHackers

Clearance corner

Forensic triage is now a documented, timed deliverable

CISA's BOD 26-04 implementation guidance lays out forensic triage steps: scope the notification, gather evidence, contain, analyze, then decide whether to escalate. ISSOs should have templates and escalation paths pre-built before the next three-day-tier CVE lands, not improvised under deadline.

Inside Government Contracts|CISA Implementation Guidance

KEV entries now carry variable, not fixed, deadlines

BOD 26-04 replaces the old all-KEV remediation model with a risk-based process that considers public exposure, KEV status, exploit automation, and technical impact, so two CVEs added the same day can carry very different due dates depending on those four variables. Agencies tracking compliance manually against a single 'KEV means X days' rule of thumb will misjudge their actual deadlines.

shattered.io

What we are watching next

September 21 Linux kernel deadline
FCEB agencies must remediate or mitigate CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 by Monday, September 21; watch for CISA guidance on whether forensic triage applies given the total-control criteria.
September 25 Artifactory deadline
The JFrog Artifactory token-validation flaws from the MikroTrick-adjacent KEV batch come due next week; confirm exposure of anonymous-access configurations now.
Check Point exploitation status
CVE-2026-91843 has no confirmed in-the-wild exploitation yet, but the pre-auth nature and management-plane impact make it a prime candidate for a fast follow-on KEV addition.
Settra's next move
Settra keeps posting victims to its leak site, and Huntress could not confirm initial access in either intrusion. Watch for follow-up research on how it gets in; MoxFive points to compromised VPN credentials.

Corrections

Corrected September 19, 2026: The federal deadline is Monday, September 21, not Sunday. Kernel fix versions are now listed per CVE; CVE-2025-39964 requires newer kernels than originally stated. Settra and Feral Wolf details were corrected, and the JadePuffer item moved to trends because it was first reported in July.