The 5-Minute Cyber Brief: September 14, 2026

Published: 09/14/26

Two federal deadlines land today. A GitLab file-read bug went from disclosure to KEV in a day, and a ScreenConnect client bug lets a support session take over the host; both are due today. Also in this issue: Chrome’s seventh exploited zero-day of 2026, and a WatchGuard Firebox RCE that CISA now flags for ransomware use.

Lead Story

GitLab CVE-2026-85706: Unauth File Read, Due Today

CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab’s repository commits API. An unauthenticated attacker can read arbitrary server files. Fixed in 19.3.2 / 19.2.6 / 19.1.8. watchTowr saw probes within ~24 hours; CISA KEV due September 14, 2026.

Why it matters: Patch self-managed CE/EE now, hunt file.path POSTs to the commits API, and rotate secrets if the instance was exposed.

Read more on CyberExperts: Read the analysis

Also Worth Your Attention

ScreenConnect Client: Session Transfer Without Host OK

CVE-2026-84869 (CVSS 9.9) lets a low-privilege active session transfer and execute files on the host without confirmation. Fix: client 26.6.5+, then reinstall host clients/agents. Huntress linked observed VBScript worm-like spread. KEV due September 14.

Why it matters: Upgrade on-prem, refresh every agent, or strip TransferFiles permissions until you can.

Read more on CyberExperts: Read more

Chrome’s Seventh Exploited Zero-Day of 2026

CVE-2026-87491 is a V8 out-of-bounds write fixed in Chrome 153.0.8010.36/.37. Google confirms an in-the-wild exploit. CISA added it to KEV on September 9.

Why it matters: Force Chromium-family browsers to 153+ and make sure they relaunch. Sandbox RCEs are rarely used on their own.

Read more on CyberExperts: Read more

WatchGuard Firebox: Ransomware Now Named on an Old Edge RCE

CVE-2025-14733 (iked OOB write, unauth RCE) was already in KEV. On September 10, CISA updated the entry to mark known ransomware campaign use. ~9,000 Fireboxes still exposed online per Shadowserver-linked reporting.

Why it matters: Get to fixed Fireware builds, hunt WatchGuard IoCs, and rotate Firebox-stored secrets if you were exposed.

Read more on CyberExperts: Read the analysis

Go Deeper

Related reading: Cybersecurity Tools · Cybersecurity Frameworks · Get the Daily Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].