September 7–13: Prioritize Exploited Edge Systems and Identity Abuse

Threat groups are reportedly exploiting recently patched flaws in Cisco Secure Firewall Management Center, including a critical authentication-bypass issue identified as CVE-2026-20079. The supplied account says the activity has involved credential theft, elevated access, and deployment of Qilin ransomware. That description comes from reporting on Cisco Talos findings; it should be read as an account of observed or attributed activity, not as proof that every exposed FMC system has been compromised or that Qilin is present in every incident. The available material does not provide a complete victim list, exploitation window, or reliable prevalence estimate. Secure Firewall Management Center is a high-value administrative component, so compromise could give an attacker a path to sensitive configuration, credentials, and network-control functions. Organizations should confirm whether affected versions were exposed, whether patches were applied, and whether administrative activity around the relevant systems is consistent with normal operations. Incident responders should preserve logs before making disruptive changes and investigate adjacent devices and credentials.

CISA has added two MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities Catalog, indicating that exploitation has been observed in the wild. The entries are CVE-2026-67277, described as missing authentication for a critical function, and CVE-2026-86060, involving improper neutralization of argument delimiters in a command. The advisory does not describe a specific victim, campaign, or exploitation method, so the scope of civilian impact remains unclear. It does, however, identify RouterOS systems as a priority for investigation, particularly where devices are reachable from the public internet or could provide broad control after compromise. CISA’s notice also references Binding Operational Directive 26-04, which sets risk-based vulnerability management expectations for Federal Civilian Executive Branch agencies. For other organizations, the KEV listing is still a useful signal that ordinary patch queues may be insufficient. Teams should confirm whether affected RouterOS versions are deployed, determine exposure, apply the vendor-supported fix or mitigation when available, and look for signs of prior compromise rather than assuming remediation alone closes the risk.

A critical vulnerability identified as CVE-2026-75650 affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw is described as an unauthenticated remote-code-execution issue, meaning an attacker may not need a valid account before attempting to run code on an exposed store. Exploitation was reportedly observed from September 4, before Adobe released a hotfix on September 7. Multiple victim stores and attack campaigns were reported by researchers, but the supplied material does not establish the full number of affected organizations or the breadth of the activity. The issue has been given the name “StyleSmuggler” in research coverage; that label does not by itself describe the exploit’s technical cause. Store operators should treat internet-facing installations as urgent investigation targets, especially where patching was delayed during the exposure window. Applying the vendor hotfix is necessary, but it should not replace an examination for prior compromise. Teams should review web-server, application, administrative, payment, and hosting logs for unexpected requests, file changes, new accounts, altered extensions, and outbound connections. If compromise is suspected, isolate the system carefully, preserve evidence, rotate secrets from a trusted environment, and validate the integrity of payment and customer-data workflows before returning to normal operation.

IDScan reportedly confirmed a breach involving names, driver’s licenses, and other government-issued identity documents at very large scale. If the exposed material is authentic and usable, it could support impersonation, account-opening fraud, targeted phishing, and attempts to bypass identity checks. The immediate risk is not limited to the original document holders: banks, employers, insurers, public agencies, and online services may face more convincing enrollment or account-recovery attempts. The supplied reporting does not establish the full affected population, the exact records accessed, whether every document was exfiltrated, or whether the data is already being misused. Those are important verification limits. Organizations should not wait for proof of downstream fraud before tightening high-risk identity workflows. Individuals should also be cautious about unsolicited notices, requests for fresh identification, and messages that use personal details to create credibility. Controls should focus on detecting inconsistent identity signals and adding human review where a stolen document alone would otherwise be sufficient.

Revolut reportedly disclosed customer identity-verification material, selfies, and Bitcoin transaction histories after receiving fraudulent requests from an email environment belonging to a real government agency. The company confirmed the disclosure on September 12, 2026. The important lesson is not that government domains are inherently unsafe; it is that domain legitimacy and mailbox authenticity do not establish that a request is authorized, current, or genuinely sent by the named official. The attacker claim was that the request was a legitimate government demand. That claim was false, according to the available reporting and Revolut’s confirmation. The supplied information does not establish how the account was accessed, which agency was involved, how many customers were affected, or whether every listed data type was disclosed in every case. Organizations handling sensitive records should therefore treat email-based authority as one signal among several. High-impact disclosures need independent confirmation through a known channel, documented legal validation, least-necessary data selection, and escalation when a request is unusual or urgent.