The 5-Minute Cyber Brief: September 18, 2026

Published: 09/18/26

Friday’s brief is a management-plane clock day: Cisco ISE’s CVSS 10 unauth→root bypass is due Saturday, Acronis hosting backup LPE shares that federal deadline, MikroTik’s MikroTrick SSH chain is still owning exposed routers, and Check Point just shipped a LivePatch for unauthenticated root on the policy brain.

Lead Story

Cisco ISE: Unauth Management Bypass to Root — Due Tomorrow

Insufficient authentication on an ISE/ISE-PIC API lets attackers bypass the web management interface and may yield root. Active exploitation confirmed; no workarounds; KEV due September 19.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Why it matters: ISE is the NAC brain. Root there pivots every downstream authenticated network. Patch, iACL the management plane, hunt access logs, re-image if dirty.

Read more on CyberExperts: Read the analysis

Also Worth Your Attention

Acronis Backup: Hosting LPE, Same Saturday Clock

Default-permissions escalation on cPanel/Plesk Acronis agents under limited targeted exploitation. One account foothold can become every tenant’s backups.

Why it matters: Multi-tenant backup agents are trust-boundary software. Fix 1.9.3 HF3 / 1.8.11 and hunt.

Read more on CyberExperts: Read more

MikroTik RouterOS: MikroTrick SSH Hijack

Unauth SSH auth-bypass + privilege escalation chain; two CVEs on KEV. Upgrade and pull management off the internet.

Why it matters: Edge routers with open SSH are takeover candy. Check Flagged status after patch.

Read more on CyberExperts: Read more

Check Point Management: Unauth Stack Overflow to Root

Pre-auth login overflow on Security Management / Log servers. LivePatch via sk1000155; lock Trusted Clients.

Why it matters: Root on the policy brain rewrites every gateway it manages.