Five additions to CISA’s exploited catalog drive Layer8’s September 13–19 priorities. Weigh exposure and business impact, then confirm the affected product and deployment.
KEV dates below record catalog entry, not initial disclosure. Remediation guidance reflects October 3 review.
| CVE | Applicability and impact | Remediation | Exploitation |
|---|---|---|---|
| CVE-2025-39682 | Linux using kernel TLS: availability risk. | Apply the distribution’s fixed package, including backports. | KEV September 18. |
| CVE-2025-39964 | Linux: local users could crash systems or corrupt cryptographic results. | Follow distribution status and fixes. | KEV September 18. |
| CVE-2026-53266 | Linux with specific bridge networking configurations: local privilege escalation or service outage. | Check distribution status; use available fixes or vendor mitigation. | KEV September 18. |
| CVE-2026-76460 | Cisco ISE/ISE-PIC, regardless of configuration: unauthorized remote access. | Install 3.1 Patch 12; 3.2 Patch 11; 3.3 Patch 12; 3.4 Patch 7; 3.5 Patch 4. Migrate obsolete releases. No workaround; access restriction is temporary mitigation. | Active; KEV September 16. |
| CVE-2026-87886 | Acronis Backup’s Linux panel integrations: local privilege escalation. | cPanel/WHM 1.9.3.1021; Plesk 1.8.11.638; DirectAdmin 1.2.3.238 or later. | KEV September 16; CVE record published September 17. |
Managed IT could assign patch owners, record exceptions and verify approved changes within the agreed server and networking scope. Confirm installed fixes and service health; escalate suspected compromise separately, because patching alone does not establish recovery.