{
  "range": {
    "from": "2026-09-17",
    "to": "2026-09-23",
    "days": 7
  },
  "summary": {
    "total_kev_new": 6,
    "total_software_update": 0,
    "by_date": {
      "2026-09-19": {
        "kev_new": 3,
        "software_update": 0
      },
      "2026-09-17": {
        "kev_new": 3,
        "software_update": 0
      }
    }
  },
  "kev_new": [
    {
      "digest_date": "2026-09-19",
      "key": "CVE-2025-39682",
      "cve_id": "CVE-2025-39682",
      "vendor_project": "Linux",
      "product": "Kernel",
      "vulnerability_name": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability",
      "date_added": "2026-09-18",
      "short_description": "Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-09-21",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": null,
      "epss_score": null
    },
    {
      "digest_date": "2026-09-19",
      "key": "CVE-2025-39964",
      "cve_id": "CVE-2025-39964",
      "vendor_project": "Linux",
      "product": "Kernel",
      "vulnerability_name": "Linux Kernel Race Condition Vulnerability",
      "date_added": "2026-09-18",
      "short_description": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-09-21",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": null,
      "epss_score": null
    },
    {
      "digest_date": "2026-09-19",
      "key": "CVE-2026-53266",
      "cve_id": "CVE-2026-53266",
      "vendor_project": "Linux",
      "product": "Kernel",
      "vulnerability_name": "Linux Kernel Out-of-Bounds Write Vulnerability",
      "date_added": "2026-09-18",
      "short_description": "Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-09-21",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload.  Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and wo",
      "epss_score": 0.00121
    },
    {
      "digest_date": "2026-09-17",
      "key": "CVE-2026-58704",
      "cve_id": "CVE-2026-58704",
      "vendor_project": "Google",
      "product": "Pixel",
      "vulnerability_name": "Google Pixel Improper Authorization Vulnerability",
      "date_added": "2026-09-16",
      "short_description": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-09-19",
      "known_ransomware": "Unknown",
      "cvss_score": 8.8,
      "cvss_severity": "HIGH",
      "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "A",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
      "epss_score": 0.00112
    },
    {
      "digest_date": "2026-09-17",
      "key": "CVE-2026-76460",
      "cve_id": "CVE-2026-76460",
      "vendor_project": "Cisco",
      "product": "Identity Services Engine",
      "vulnerability_name": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
      "date_added": "2026-09-16",
      "short_description": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-09-19",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": null,
      "epss_score": null
    },
    {
      "digest_date": "2026-09-17",
      "key": "CVE-2026-87886",
      "cve_id": "CVE-2026-87886",
      "vendor_project": "Acronis",
      "product": "Backup",
      "vulnerability_name": "Acronis Backup Incorrect Default Permissions Vulnerability",
      "date_added": "2026-09-16",
      "short_description": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-09-19",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": null,
      "epss_score": null
    }
  ],
  "software_update": []
}