Four additions to CISA's exploited vulnerabilities catalog and a firewall advisory put Windows, network management and remote support on this week's patch list.
Layer8 prioritizes exploitation, exposure and business impact. KEV is CISA's Known Exploited Vulnerabilities catalog; applicability depends on inventory.
| CVE | Impact and applicability | Action and exploitation evidence |
|---|---|---|
| CVE-2026-85880 | Affected Windows 10/Server ALPC releases: authorized local attackers can gain SYSTEM control. | Install security updates matching the OS and architecture. Exploited; KEV September 8. |
| CVE-2026-81963 | Affected Windows 11/Server 2025 Update Stack releases: authorized local attackers can gain SYSTEM control. | Apply updates matching the Windows release. Exploited; KEV September 8. |
| CVE-2026-0310 | PAN-OS management/data-interface network access: PA-Series takeover or VM-Series outage; Panorama affected. | Apply branch-specific fixes; confirm cloud-provider maintenance. Vendor reports no known malicious exploitation; no workaround. |
| CVE-2026-20079 | Cisco FMC, disclosed March 4: remote takeover of on-premises management systems. | Follow the September 16 fixed-release guidance; no workaround. KEV September 9. |
| CVE-2026-84869 | ScreenConnect client: unauthorized execution during active remote sessions. | Update to 26.6.5; verify client propagation. Hosted updated. On-premises: license/maintenance eligibility and supported path from 25.4+. KEV September 11. |
Within an agreed Managed IT scope, Layer8 would map affected assets, assign patch owners and verify installed versions, client updates and service health after approved changes. This could reduce missed remediation. Servers, networking, licenses and staffed coverage require agreement. Successful patching does not exclude earlier compromise.
Revised source: Cisco's advisory was updated September 16, after this sample date; its current branch-specific release guidance supersedes earlier hotfix advice.