> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # 21st September – Threat Intelligence Report - URL: https://f4n6.co.uk/security-feed/21st-september-threat-intelligence-report/ - Published: 2026-09-22T10:47:41.000Z - Updated: 2026-09-22T10:47:41.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-91843, CVE-2026-76460, CVE-2026-76461, CVE-2026-77692, WaterPlum, FamousSparrow, Handala ## 1\. Executive summary This item is a weekly intelligence digest rather than a single incident, and its actionable core is a patch cycle: Oracle's September 2026 Critical Security Update (800+ vulnerabilities, 17 product families), Cisco fixes for CVE-2026-76460 (CVSS 10.0, in CISA KEV since 2026-09-16, actively exploited per Cisco) and CVE-2026-76461 (CVSS 9.8, in CISA KEV since 2026-09-14), a Check Point management-server flaw CVE-2026-91843 (CVSS 9.8, not in KEV), and ISC BIND 9 updates including CVE-2026-77692 (CVSS 7.5, not in KEV). EMEA financial services clients running Cisco ISE, Secure Email Gateway, Check Point Security Management/Log Servers, Oracle E-Business Suite or Fusion Middleware, or internet-facing BIND 9 with DNS-over-HTTPS are exposed to unauthenticated remote compromise of security and mail infrastructure. The digest also reports four breaches (Japan Digital Agency, Brevo supply chain, Gyazo/Helpfeel, two oil tankers) and four threat reports (WaterPlum, FamousSparrow, HEAVYGRAM, GhostCode); none of the named actors has a MITRE ATT&CK profile in our verified data, so all attribution in those items is unconfirmed. No IOCs are present in the source material. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | The Oracle September 2026 CPU spans 17 product families with over 240 remotely exploitable, unauthenticated flaws, a scope too broad to patch blindly; clients must test and prioritise against their actual Oracle footprint. | Use the CPU scope to drive targeted vulnerability testing of Oracle deployments this cycle rather than blanket patching. | | DORA Art. 28: ICT third-party risk — general principles | The Brevo incident is a supply chain compromise of a SaaS marketing platform whose components were injected with malicious scripts on roughly 100,000 customer websites, propagating through a third-party component into client web estates. | Clients using Brevo or embedding third-party web components should review those relationships and the integrity monitoring obligations in those contracts. | No specific NIS2 article is engaged. NIS2 Art. 21(2)(d) (supply chain security measures) is close to the Brevo trigger, but the DORA Art. 28 row already captures the third-party exposure for the financial services audience, and the Brevo fact does not add a distinct NIS2-specific duty beyond it. ## 3\. Technical analysis & attack chain This is a patch-roundup item. Triage table first, ordered by KEV status then EPSS from verified data. | CVE | Component | CVSS | KEV / EPSS | Why it matters | | -------------- | -------------------------------------------------------- | ---- | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-76460 | Cisco ISE / Secure Email Gateway management interface | 10.0 | IN KEV (added 2026-09-16) / EPSS 1% | Actively exploited per Cisco; unauthenticated remote access to the management interface of identity and mail security infrastructure. | | CVE-2026-76461 | Cisco ISE / Secure Email Gateway | 9.8 | IN KEV (added 2026-09-14) / EPSS 2% | SQL injection (CWE-89) in the same product family; same patch cycle, patch together with 76460. | | CVE-2026-91843 | Check Point Security Management and Log Servers, R80–R82 | 9.8 | NOT in KEV / EPSS 0% | Stack overflow (CWE-121) in the login process; unauthenticated remote code execution as root on the systems that manage firewall policy. | | CVE-2026-77692 | ISC BIND 9, named with DNS-over-HTTPS | 7.5 | NOT in KEV / EPSS 0% | NULL pointer dereference (CWE-476); a single crafted DoH request crashes named. Fixed in 9.21.26 and 9.20.29. | **CVE-2026-76460 and CVE-2026-76461 (Cisco).** Both affect Cisco ISE and Secure Email Gateway. CVE-2026-76460 is rated CVSS 10.0, is in CISA KEV (added 2026-09-16), and Cisco states it is aware of active exploitation; the flaw allows an unauthenticated remote attacker to gain access to the system's management interface. Verified data classifies it as CWE-648 (incorrect use of a privileged API/chosen value), which is consistent with an exposed management interface being reached without credentials. CVE-2026-76461 is rated CVSS 9.8, is in CISA KEV (added 2026-09-14), and is a SQL injection flaw (CWE-89). The source does not give per-CVE version ranges, patch filenames, or exploitation details beyond Cisco's statement, so treat the exploitation scope as vendor-asserted and single-sourced; verify against Cisco's advisory before enforcement actions such as emergency change windows. **CVE-2026-91843 (Check Point).** A stack overflow in the login process of Security Management and Log Servers, rated CVSS 9.8, not in CISA KEV, EPSS 0%. An unauthenticated remote attacker can execute code as root on affected R80 through R82 systems. The security impact is disproportionate to the CVSS ordering in the table: compromise of a management server gives the attacker the ability to read and alter firewall policy, object definitions, and connected gateway configurations. Check Point has released a fix; the source does not name the hotfix build, so pull the current hotfix from Check Point's advisory. **CVE-2026-77692 (ISC BIND 9).** A NULL pointer dereference allowing an unauthenticated remote attacker to crash the named process with a single crafted DNS-over-HTTPS request. Rated CVSS 7.5, not in KEV. This is a denial-of-service condition, not code execution, but it affects any resolver or authoritative server with DoH enabled that handles untrusted queries. Fixes are in BIND 9.21.26 and 9.20.29\. The wider ISC update addresses 14 vulnerabilities, seven of them high-severity DoS conditions; the source does not enumerate the other 13. **Oracle September 2026 CPU.** More than 800 vulnerabilities across 17 product families; more than 100 rated critical and over 240 remotely exploitable without authentication. Named families: E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM, Analytics, Communications, Virtualization. The source gives no per-CVE detail, so no per-CVE analysis is possible; the triage posture is footprint-driven (see §4). **Breaches and campaigns (context, no client-specific action beyond §4).** Japan's Digital Agency confirmed a breach via a VPN appliance vulnerability, exposing about 246,000 records of government officials and contractors; financial information was not affected. Brevo, a French customer communication platform, confirmed a supply chain attack in which a compromised Cloudflare API key was used to inject malicious ClickFix scripts into websites using Brevo components, affecting roughly 100,000 websites. Helpfeel, operator of Japanese image-sharing service Gyazo, reported a breach via an image upload server vulnerability exposing over 23 million user records and 490 million image metadata records, including email addresses, password hashes, session IDs, integration tokens, and location metadata. Two oil tankers bound for Texas suffered cyberattacks disrupting onboard systems; US Coast Guard and FBI personnel boarded the vessels, malicious activity was confirmed on the VL Prosperity, and no attribution has been made public. On the threat reports: WaterPlum (Contagious Interview) is described by US, Japanese, Australian, and German authorities as a North Korea-linked campaign that infected at least 30,000 devices across more than 100 countries, with operators posing as AI or blockchain employers targeting IT professionals and stealing from over 7,000 cryptocurrency wallets between December 2025 and July 2026\. FamousSparrow is described as a China-aligned espionage campaign against Latin American government entities and a Puerto Rico telecommunications organisation, deploying a new backdoor called SparroWocky that replaces the long-running SparrowDoor implant. HEAVYGRAM is a Windows surveillance backdoor linked with moderate confidence to the Iranian Handala group, active since 2023 against Iranian dissidents and journalists, using Telegram for command and control, executing commands, capturing screenshots, stealing Telegram session data, exfiltrating files, and maintaining persistence. GhostCode is a device-code phishing kit targeting Microsoft 365 accounts by abusing the legitimate OAuth 2.0 device authorization flow to capture tokens and register attacker-controlled devices without stealing passwords or bypassing MFA directly. WaterPlum, FamousSparrow, and Handala have no MITRE ATT&CK profile in our verified reference data, so all three attributions are unconfirmed. Every claim in this paragraph is single-sourced to the Check Point digest. ## 4\. Mitigation & containment P1 (within 24h): - Patch CVE-2026-76460 and CVE-2026-76461 on all Cisco ISE and Secure Email Gateway deployments. Both are in CISA KEV and 76460 is under active exploitation per Cisco. Until patched, restrict management-interface access to dedicated administration VLANs and remove any ISE or SEG management interface from internet-facing address space. - Patch CVE-2026-91843 on all Check Point Security Management and Log Servers running R80 through R82\. Pull the current hotfix from Check Point's advisory (the source names no build). Until patched, confirm that management interfaces are not reachable from untrusted networks; the flaw is pre-authentication, so credential hygiene does not mitigate it. - Inventory Oracle deployments against the September 2026 CPU scope (E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM, Analytics, Communications, Virtualization) and schedule the CPU within your standard emergency-change window, prioritising the over 240 remotely exploitable unauthenticated flaws on internet-facing or user-facing instances. P2 (within 72h): - Upgrade BIND 9 to 9.21.26 or 9.20.29 on all resolvers and authoritative servers with DNS-over-HTTPS enabled. If upgrade is delayed, evaluate whether DoH listeners need to be exposed to untrusted clients at all; the crash vector is a single crafted request. - Review the remaining 13 BIND vulnerabilities in the ISC update against your BIND feature set (the source does not enumerate them; pull the ISC advisory). - If your organisation uses Brevo components or similar third-party web widgets, check those pages for injected ClickFix scripts (fake CAPTCHA/verification prompts that lead to clipboard or download attacks) and confirm the vendor's remediation status. Rotate any Cloudflare API keys with write access to web assets. - Brief SOC and fraud teams on GhostCode's device-code phishing pattern: Microsoft 365 sign-in logs showing device-code flow completions from unfamiliar devices or geographies, where the user authenticated successfully but no password theft occurred. Standard credential-reset playbooks do not revoke device registrations; revoke tokens and deregister devices. P3 (within 7 days): - For the WaterPlum pattern, warn recruitment-facing staff and contractors about fake AI/blockchain employer lures; the campaign targets IT professionals specifically. - If you operate maritime or logistics subsidiaries, note the unattributed tanker incidents and confirm OT/IT segmentation on vessel systems is within your third-party assurance scope. - Fold the Oracle CPU and Cisco/Check Point/BIND fixes into your next patch-verification cycle and confirm closure against the KEV entries. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes observable behaviours but no atomic indicators. Behavioural indicators: | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | -------------------------------------- | | Device-code flow authentication completing on Microsoft 365 accounts from unrecognised devices (GhostCode kit) | Entra ID sign-in logs, device registration logs | Moderate; single-sourced to the digest | | ClickFix-style script injection on websites using Brevo components | Web content integrity monitoring, CSP violation reports, script diffing on marketing pages | Moderate; single-sourced | | Telegram API traffic from Windows endpoints combined with screenshot and file-collection behaviour (HEAVYGRAM) | EDR process monitoring, egress firewall logs to Telegram API endpoints | Moderate; single-sourced | ## 6\. Detection Insufficient indicators to author detection rules. The source names no file paths, command lines, mutexes, registry keys, or strings belonging to any of the described malware or scripts. SparroWocky, HEAVYGRAM, Luciferus, and the ClickFix scripts are described only at capability level, and none of those descriptions supplies a rule-grade artefact. The behavioural indicators in §5 are the usable detection material. ## CVE assessment 4 referenced CVEs — **2 actively exploited (CISA KEV)**, 3 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-76460](https://nvd.nist.gov/vuln/detail/CVE-2026-76460?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2026-09-16 | 1% | A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass aut… | | [CVE-2026-76461](https://nvd.nist.gov/vuln/detail/CVE-2026-76461?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-09-14 | 2% | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, r… | | [CVE-2026-91843](https://nvd.nist.gov/vuln/detail/CVE-2026-91843?ref=f4n6.co.uk) | 9.8 Critical | — | 0% | A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privil… | | [CVE-2026-77692](https://nvd.nist.gov/vuln/detail/CVE-2026-77692?ref=f4n6.co.uk) | 7.5 High | — | 0% | An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) reco… | ## 7\. Sources - Check Point Research, "21st September – Threat Intelligence Report", https://research.checkpoint.com/2026/21st-september-threat-intelligence-report/, 2026-09-21 - Check Point Research, "22nd June – Threat Intelligence Report", https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/, 2026-06-22 (context only) - Check Point Research, "8th June – Threat Intelligence Report", https://research.checkpoint.com/2026/8th-june-threat-intelligence-report/, 2026-06-08 (context only) - Check Point Research, "27th July – Threat Intelligence Report", https://research.checkpoint.com/2026/27th-july-threat-intelligence-report/, 2026-07-27 (context only) - Check Point Research, "24th August – Threat Intelligence Report", https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/, 2026-08-24 (context only) - Check Point Research, "3rd August – Threat Intelligence Report", https://research.checkpoint.com/2026/3rd-august-threat-intelligence-report/, 2026-08-03 (context only) - Check Point Research, "17th August – Threat Intelligence Report", https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/, 2026-08-17 (context only) ## 8\. Adverse Trace position We assess the patch cycle as the material risk in this item: two KEV-listed Cisco flaws in identity and mail security products, one of them under active exploitation, plus a pre-authentication root code execution flaw on Check Point management servers, together expose the exact infrastructure classes (identity, email, firewall management) that EMEA financial services clients rely on for their own security operations. Severity follows the verified data and we have not re-assessed it: CVSS 10.0 and 9.8 for the Cisco pair, 9.8 for Check Point, 7.5 for BIND. Attribution across the campaign items (WaterPlum, FamousSparrow, Handala) is unconfirmed in our reference data and should not drive threat-hunting priorities on its own. The entire item is single-sourced to one vendor digest, and it contains no IOCs, so enforcement actions should wait for vendor advisories and primary reporting; we will issue a supplemental note if Cisco, Check Point, ISC, or Oracle publish technical detail, and we are monitoring the KEV entries for remediation deadlines. --- [Read the original source →](https://research.checkpoint.com/2026/21st-september-threat-intelligence-report/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*