Thursday, September 24, 2026|Issue 6|6 min read|Join the discussion
The systems with the most operational authority keep becoming the systems attackers want most
Ransomware-linked TeamCity exploitation, identity-focused social engineering, an exploited Zyxel switch flaw, and new OT supply-chain guidance all point to the same question: what can an attacker inherit after compromising the thing you trust?
The short version
- CISA now marks the TeamCity flaw CVE-2026-63077 as used in ransomware campaigns; JetBrains fixed it in July in 2025.11.7 and 2026.1.3.
- Astrana Health told the SEC attackers impersonated staff and spoofed its main phone number to talk employees into system access; data was taken, scope still under review.
- The federal deadline for the exploited Zyxel GS1900 switch flaw CVE-2026-7273 is today, September 24.
- NIST opened comments on draft SP 800-82 Rev. 4 through November 30, and CISA and the FBI issued a fact sheet on the risks of third-party ICS integrators.
Issue at a glance
1 critical2 high1 notable
- criticalRansomwareTeamCity CVE-2026-63077 is now tied to ransomware campaigns
- highIdentityAstrana Health breach started with a spoofed corporate phone number
- highPolicyZyxel GS1900 switch flaw hits its federal deadline today
- notableSupply chainNIST drafts SP 800-82 Rev. 4 as CISA and FBI flag ICS integrator risk
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-7273 | Zyxel GS1900 series switches | Stack-based buffer overflow in the CGI program; a LAN-based, unauthenticated attacker could execute OS commands via a crafted HTTP request. | Actively exploited (KEV); CVSS 3.1 8.8 per Zyxel |
Also on the vulnerability desk
- Carryover, due tomorrow (September 25): F5 BIG-IP APM CVE-2026-94127, added to KEV September 22. Not new today.
CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog|F5 — K000162605
- Carryover, due September 25: Check Point CVE-2026-85102 (Security Gateway and Spark Firewall VPN) and CVE-2026-93616 (Security Management). Not new today.
CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog|CISA — Known Exploited Vulnerabilities Catalog
- Carryover, due September 25: Arista VeloCloud Orchestrator CVE-2026-93952. Not new today.
CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog|Arista — Security Advisory 0144
CISA — CISA Adds One Known Exploited Vulnerability to Catalog|Zyxel — Security advisory for stack-based buffer overflow in GS1900 series switches|CISA — Known Exploited Vulnerabilities Catalog
Breaking
CI/CD / ransomware / vulnerability
TeamCity CVE-2026-63077 is now tied to ransomware campaigns
CISA updated its KEV entry for CVE-2026-63077, the unauthenticated remote code execution flaw in TeamCity On-Premises, to show it is known to be used in ransomware campaigns, BleepingComputer reports. JetBrains patched it in July, confirmed in-the-wild exploitation in August, and CISA first added it to KEV on August 5. CISA has not published details of the ransomware activity.
Why it matters. A build server is not just another host. JetBrains says a successful attack can expose stored credentials and potentially compromise build artifacts and downstream pipelines. Whoever holds the CI/CD server can reach source code, signing material, and deploy credentials, and can ship software that the rest of the organization trusts by default.
What to do. Upgrade TeamCity On-Premises to 2025.11.7 or 2026.1.3; if you cannot, JetBrains offers a security patch plugin for 2017.1 and later and advises limiting access to trusted networks. TeamCity Cloud needs no action. Hunt with JetBrains' indicators, and if a server was exposed unpatched, rotate the credentials and tokens it stores and review recent build artifacts.
CVE-2026-63077
BleepingComputer — CISA: Ransomware gangs now exploiting critical TeamCity flaw|JetBrains — Critical security issue affecting TeamCity On-Premises (CVE-2026-63077)|JetBrains — CVE-2026-63077: additional guidance following reports of active exploitation
identity / social engineering / healthcare
Astrana Health breach started with a spoofed corporate phone number
Astrana Health disclosed a material incident at subsidiary Astrana Health Management in an SEC filing. Attackers impersonated company personnel and spoofed its main phone number while contacting employees to gain access to systems, and private and confidential information was accessed and exfiltrated. The company is still assessing whether patient, employee, provider, business, financial, or intellectual-property data was involved. No attribution has been made public.
Why it matters. The attack went through people and process, not a software flaw. When caller ID shows your own number, employees extend trust the attacker never earned. Help desks, remote support, and credential resets are identity controls, and they are being targeted like one.
What to do. Require callback to a known directory number for any access, MFA, or password request, regardless of caller ID. Lock down which remote access tools are allowed, and log and alert on new remote sessions and help-desk-initiated resets.
SecurityWeek — Astrana Health data breach impacts private, confidential information|Astrana Health — SEC Form 8-K (Item 1.05)
network / vulnerability / KEV
Zyxel GS1900 switch flaw hits its federal deadline today
CISA added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to KEV on September 21 with a September 24 due date. Zyxel says an unauthenticated attacker on the LAN could execute OS commands with a crafted HTTP request. Zyxel shipped fixed firmware in June; BleepingComputer notes Zyxel had not updated its advisory to confirm exploitation.
Why it matters. The attacker needs LAN reach, so this is less about internet exposure and more about what happens after a foothold. A compromised switch sits where it can see and redirect traffic, and under BOD 26-04 the question is not only whether it is patched but whether it was touched before the patch.
What to do. Apply Zyxel's fixed firmware for your model (for example, GS1900-48HPv2 to 2.90(ABTQ.2)C0; Zyxel's advisory lists each model). Restrict the management web interface to a management VLAN, and check affected switches for unexpected configuration changes before calling them clean.
CVE-2026-7273
CISA — CISA Adds One Known Exploited Vulnerability to Catalog|Zyxel — Security advisory for stack-based buffer overflow in GS1900 series switches|BleepingComputer — CISA orders feds to patch Zyxel flaw exploited for data theft|CISA — BOD 26-04: Prioritizing security updates based on risk
OT / ICS / supply chain / policy
NIST drafts SP 800-82 Rev. 4 as CISA and FBI flag ICS integrator risk
NIST released the initial public draft of SP 800-82 Rev. 4, its Guide to OT Security, with comments due November 30, 2026. The draft is restructured around CSF 2.0 and adds sectors including water, building automation, freight rail and maritime. Separately, CISA and the FBI published a fact sheet urging least privilege for third-party ICS integrators, citing a 2025 intrusion at an integrator that served power and transportation customers.
Why it matters. An integrator with remote access to many operators is a supply-chain path into all of them. Industrial Cyber reports the cited intrusion involved searches for customer and SCADA data and staged files for presumed exfiltration.
What to do. Inventory which integrators hold standing remote access to your OT, cut it to least privilege and time-bound sessions, and write integrator security expectations into contracts. OT teams should review the draft and comment by November 30.
NIST CSRC — SP 800-82 Rev. 4 initial public draft|NIST — NIST requests comments on draft SP 800-82r4|CISA/FBI — Considerations for critical infrastructure operators working with third-party ICS integrators|SecurityWeek — NIST drafts updated OT guide, CISA/FBI advise on ICS integrators|Industrial Cyber — CISA, FBI warn operators of third-party ICS risks
Trends
CI/CD is becoming Tier-0 infrastructure
This week keeps circling authority. A developer can publish code, an AI agent can act, a firewall controls traffic, and a CI/CD server can manufacture and deploy software. The TeamCity ransomware flag is the latest reminder that build servers hold credentials and produce artifacts everyone downstream trusts. Asset criticality should ask not only what data a system stores but what it can cause other systems to do.
BleepingComputer — CISA: Ransomware gangs now exploiting critical TeamCity flaw|JetBrains — Critical security issue affecting TeamCity On-Premises (CVE-2026-63077)
Social engineering is moving deeper into identity processes
Astrana's disclosure describes impersonation plus a spoofed corporate number used against employees, followed by credential resets and restrictions on remote access tools during recovery. The weak link is the process that grants or restores access. Verification steps for help desks, remote support and resets deserve the same rigor as MFA.
SecurityWeek — Astrana Health data breach impacts private, confidential information|Astrana Health — SEC Form 8-K (Item 1.05)
OT security is becoming enterprise risk management
NIST's draft explicitly ties OT risk management to enterprise risk management and the CSF Govern function, and the CISA/FBI fact sheet treats integrators as part of the operator's risk. OT risk now spans IT, identity, cloud convergence, vendors and physical consequences, and has to be owned at that level.
NIST CSRC — SP 800-82 Rev. 4 initial public draft|CISA/FBI — Considerations for critical infrastructure operators working with third-party ICS integrators
Clearance corner
SP 800-82 Rev. 4 and integrator access are compliance work, not just engineering
For federal and defense programs with OT, the draft discusses adopting the NIST RMF in an appendix and aligns to CSF 2.0, so assessors will eventually map to it. The CISA/FBI fact sheet gives ISSOs concrete language for integrator least privilege and remote access. Comments on the draft are due November 30, 2026.
NIST CSRC — SP 800-82 Rev. 4 initial public draft|CISA/FBI — Considerations for critical infrastructure operators working with third-party ICS integrators
What we are watching next
TeamCity ransomware details
Whether CISA, JetBrains or incident responders name the ransomware groups or share telemetry for CVE-2026-63077.
KEV carryover deadline
F5, Check Point and Arista KEV fixes are due Friday, September 25.
Astrana breach scope
Which data categories were affected and whether breach notifications follow.
ICS integrator compromises
Follow-on reporting on integrator intrusions after the CISA/FBI fact sheet.
SP 800-82 Rev. 4 comments
The public comment period on the draft runs through November 30, 2026.
Sources
- CISA — CISA Adds One Known Exploited Vulnerability to Catalog
- Zyxel — Security advisory for stack-based buffer overflow in GS1900 series switches
- CISA — Known Exploited Vulnerabilities Catalog
- CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog
- F5 — K000162605
- Arista — Security Advisory 0144
- BleepingComputer — CISA: Ransomware gangs now exploiting critical TeamCity flaw
- JetBrains — Critical security issue affecting TeamCity On-Premises (CVE-2026-63077)
- JetBrains — CVE-2026-63077: additional guidance following reports of active exploitation
- SecurityWeek — Astrana Health data breach impacts private, confidential information
- Astrana Health — SEC Form 8-K (Item 1.05)
- BleepingComputer — CISA orders feds to patch Zyxel flaw exploited for data theft
- CISA — BOD 26-04: Prioritizing security updates based on risk
- NIST CSRC — SP 800-82 Rev. 4 initial public draft
- NIST — NIST requests comments on draft SP 800-82r4
- CISA/FBI — Considerations for critical infrastructure operators working with third-party ICS integrators
- SecurityWeek — NIST drafts updated OT guide, CISA/FBI advise on ICS integrators
- Industrial Cyber — CISA, FBI warn operators of third-party ICS risks
Join the discussion
Loading comments…