// day
Sep 9, 2026
5 new incidents, 0 with updates.
## started
- highclosedpatchedclosed Sep 9, 2026
Chrome zero-day CVE-2026-87491 (V8 OOB write)
› Google Chrome / Chromium V8
September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.
CVE-2026-87491 - highclosedpatchedclosed Sep 9, 2026
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using
› Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. Added to CISA KEV on 2026-09-09.
CVE-2026-20079 - highclosedpatchedclosed Sep 9, 2026
Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
› Citrix NetScaler
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. Added to CISA KEV on 2026-09-09.
CVE-2026-19490 - highclosedpatchedclosed Sep 9, 2026
Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
› Fortinet Multiple Products
Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Added to CISA KEV on 2026-09-09.
CVE-2025-25249 - highlivepartial fixsince Sep 9, 2026
PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken
› PingCAP TiDB Cloud (hosted database platform)
PingCAP confirmed that between Sep 9 and Oct 7 2026 an unauthorized party used stolen service-account credentials to access internal systems, copy data and obtain source code. Exported records included TiDB Cloud user names/emails, org/project associations, SQL-editor text, billing/contract data and an encrypted API-key table. Extortion group FulcrumSec claims 10.6 TB and 115k plaintext API keys; those figures are unverified and PingCAP disputes the API-key claim. No evidence data stored in TiDB was affected.
