The 5-Minute Cyber Brief: September 18, 2026

By George Bailey   Published: 09/17/26   Updated: 09/24/26   2 min read
Cybersecurity

Published: 09/18/26

Friday’s brief is a management-plane clock day: Cisco ISE’s CVSS 10 unauth→root bypass is due Saturday, Acronis hosting backup LPE shares that federal deadline, MikroTik’s MikroTrick SSH chain is still owning exposed routers, and Check Point just shipped a LivePatch for unauthenticated root on the policy brain.

Lead Story

Cisco ISE: Unauth Management Bypass to Root — Due Tomorrow

Insufficient authentication on an ISE/ISE-PIC API lets attackers bypass the web management interface and may yield root. Active exploitation confirmed; no workarounds; KEV due September 19.

Why it matters: ISE is the NAC brain. Root there pivots every downstream authenticated network. Patch, iACL the management plane, hunt access logs, re-image if dirty.

Read more on CyberExperts: Read the analysis

Also Worth Your Attention

Acronis Backup: Hosting LPE, Same Saturday Clock

Default-permissions escalation on cPanel/Plesk Acronis agents under limited targeted exploitation. One account foothold can become every tenant’s backups.

Why it matters: Multi-tenant backup agents are trust-boundary software. Fix 1.9.3 HF3 / 1.8.11 and hunt.

Read more on CyberExperts: Read more

MikroTik RouterOS: MikroTrick SSH Hijack

Unauth SSH auth-bypass + privilege escalation chain; two CVEs on KEV. Upgrade and pull management off the internet.

Why it matters: Edge routers with open SSH are takeover candy. Check Flagged status after patch.

Read more on CyberExperts: Read more

Check Point Management: Unauth Stack Overflow to Root

Pre-auth login overflow on Security Management / Log servers. LivePatch via sk1000155; lock Trusted Clients.

Why it matters: Root on the policy brain rewrites every gateway it manages.

Read more on CyberExperts: Read the analysis

Related reading: Cybersecurity Tools · Cybersecurity Frameworks · Get the Daily Brief

Stay Current

Newer CyberExperts coverage on this topic

This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.

Latest Daily Brief

Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress

The fastest way to catch up on what changed after this article was published.

Read Today's Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].