The 5-Minute Cyber Brief: September 17, 2026

Published: 09/17/26

Thursday’s brief: a CVSS 10 pre-auth hit on N-able N-central (the MSP brain), JFrog Artifactory admin chains dropping Rust backdoors, Citrix NetScaler gateway bypass already in the wild, and a brand-new Google Pixel KEV with a September 19 federal clock.

Lead Story

N-able N-central: Pre-Auth RCE on the MSP Brain

Unauthenticated code execution on on-prem N-central (fixed in Hotfix 4 / 2026.3.1.14) can be chained with earlier auth bypasses to mint admin accounts. Exploitation predated disclosure; CISA put it on KEV September 8.

Why it matters: One console foothold becomes every managed customer endpoint. Patch, then look for admin accounts you don’t recognize, especially ones with .invalid emails.

Read more on CyberExperts: Read the analysis

Also Worth Your Attention

JFrog Artifactory: Unauth → Admin → Backdoor

Wiz saw attackers chain token flaws into administrator scope in under five minutes, then drop Groovy plugins and a Rust C2. Patch does not revoke minted tokens or join keys.

Why it matters: Your artifact server is the trust root for build pipelines.

Read more on CyberExperts: Read more

Citrix NetScaler: Gateway Bypass in the Wild

Critical auth bypass on gateway/AAA profiles, patched August 19, exploited from ~September 3 after a public PoC, and added to KEV September 10.

Why it matters: Edge VPN and AAA are where “unauth” becomes “inside.”

Read more on CyberExperts: Read more

Google Pixel: Fresh KEV, Due September 19

CISA added a Pixel cellular-modem improper-authorization bug on September 16. Verify MDM security patch levels; quarantine stale devices from SSO and VPN.

Why it matters: Phones carry MFA and mail sessions, so a modem privilege bug on a Pixel is a company problem too.

Read more on CyberExperts: Read the analysis

Related reading: Cybersecurity Tools · Common Encryption Methods · Get the Daily Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].