The Wednesday BriefingWednesday, September 9, 2026
Are synced passkeys phishing-resistant?
Wednesday, September 9, 2026. Covers September 3, 2026 to September 9, 2026.
From the editor
NIST’s 800-63-4 update accepts synced passkeys at AAL2. This week we look at what stays phishing-resistant when passkeys sync, and what moves to the sync account.
In this issue
New Explainer
Are synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.
Route to IAM engineers Security engineers CISOs
Exploited this week
9 additions to CISA’s KEV catalog, Sep 3 to Sep 9.
| CVE | Vendor and product | Vulnerability | Added | Due (federal) | Ransomware use |
|---|---|---|---|---|---|
| CVE-2026-87491 | Google Chromium V8 | Google Chromium V8 Out of Bounds Write VulnerabilityCISA summaryGoogle Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Unknown | ||
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA summaryCisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. | Unknown | ||
| CVE-2026-19490 | Citrix NetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA summaryCitrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. | Unknown | ||
| CVE-2025-25249 | Fortinet Multiple Products | Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityCISA summaryFortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. | Unknown | ||
| CVE-2026-86218 | N-able N-central | N-able N-central Static Code Injection VulnerabilityCISA summaryN-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. | Unknown | ||
| CVE-2026-85880 | Microsoft Windows | Microsoft Windows Heap-Based Buffer Overflow VulnerabilityCISA summaryMicrosoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. | Unknown | ||
| CVE-2026-81963 | Microsoft Windows | Microsoft Windows Link Following VulnerabilityCISA summaryMicrosoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. | Unknown | ||
| CVE-2026-75650 | Adobe Commerce and Magento | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityCISA summaryAdobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. | Unknown | ||
| CVE-2026-85046 | Google Chromium V8 | Google Chromium V8 Type Confusion VulnerabilityCISA summaryGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Unknown |
Source: CISA Known Exploited Vulnerabilities catalog, version 2026.09.23. Due dates apply to US federal civilian agencies; summaries are CISA’s.