The 5-Minute Cyber Brief: September 22, 2026

Tuesday’s clock has two faces: a fresh Zyxel switch KEV due Thursday, and a Windows Update Stack KEV due today. In between: unauthenticated RCE in Ivanti Neurons for ITSM, and four more Linux local-root bugs that Monday’s kernel reboot may not have covered.

Lead Story

Zyxel GS1900: unauth LAN overflow, KEV due September 24. CISA added CVE-2026-7273 yesterday. Stack overflow in switch CGI → OS commands without a login. Patch to 2.90(.2)C0, lock down management VLANs, then triage.

Also Worth Your Attention

• Ivanti Neurons for ITSM — Two unauth deserialization RCEs (CVSS 9.8). On-prem needs September updates or 2026.2+.
• Linux LPE quartet — DirtyAH6, TUNderflow, PPPoEject, DiagSpill. Different from Monday’s KEV trio; confirm your kernel covers all four.
• Windows Update Stack — CVE-2026-81963 federal due today. Verify September cumulatives actually landed.

Go Deeper

Related reading: Cybersecurity Tools · Cybersecurity Frameworks · Get the Daily Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].