Tuesday’s clock has two faces: a fresh Zyxel switch KEV due Thursday, and a Windows Update Stack KEV due today. In between: unauthenticated RCE in Ivanti Neurons for ITSM, and four more Linux local-root bugs that Monday’s kernel reboot may not have covered.
Lead Story
Zyxel GS1900: unauth LAN overflow, KEV due September 24. CISA added CVE-2026-7273 yesterday. Stack overflow in switch CGI → OS commands without a login. Patch to 2.90(.2)C0, lock down management VLANs, then triage.
Also Worth Your Attention
- Ivanti Neurons for ITSM — Two unauth deserialization RCEs (CVSS 9.8). On-prem needs September updates or 2026.2+.
- Linux LPE quartet — DirtyAH6, TUNderflow, PPPoEject, DiagSpill. Different from Monday’s KEV trio; confirm your kernel covers all four.
- Windows Update Stack — CVE-2026-81963 federal due today. Verify September cumulatives actually landed.
Go Deeper
Related reading: Cybersecurity Tools · Cybersecurity Frameworks · Get the Daily Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
