No. 07Week of September 23, 2026This week’s briefing
Tradecraft

The Wednesday BriefingWednesday, September 9, 2026

Are synced passkeys phishing-resistant?

Wednesday, September 9, 2026. Covers September 3, 2026 to September 9, 2026.

From the editor

NIST’s 800-63-4 update accepts synced passkeys at AAL2. This week we look at what stays phishing-resistant when passkeys sync, and what moves to the sync account.

In this issue

Exploited this week

9 additions to CISA’s KEV catalog, Sep 3 to Sep 9.

CISA KEV additions, September 3, 2026 to September 9, 2026
CVEVendor and productVulnerabilityAddedDue (federal)Ransomware use
CVE-2026-87491Google Chromium V8Google Chromium V8 Out of Bounds Write Vulnerability
CISA summary

Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Unknown
CVE-2026-20079Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementCisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
CISA summary

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

Unknown
CVE-2026-19490Citrix NetScalerCitrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
CISA summary

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

Unknown
CVE-2025-25249Fortinet Multiple ProductsFortinet Multiple Products Heap-based Buffer Overflow Vulnerability
CISA summary

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

Unknown
CVE-2026-86218N-able N-centralN-able N-central Static Code Injection Vulnerability
CISA summary

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

Unknown
CVE-2026-85880Microsoft WindowsMicrosoft Windows Heap-Based Buffer Overflow Vulnerability
CISA summary

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Unknown
CVE-2026-81963Microsoft WindowsMicrosoft Windows Link Following Vulnerability
CISA summary

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

Unknown
CVE-2026-75650Adobe Commerce and MagentoAdobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
CISA summary

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.

Unknown
CVE-2026-85046Google Chromium V8Google Chromium V8 Type Confusion Vulnerability
CISA summary

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Unknown

Source: CISA Known Exploited Vulnerabilities catalog, version 2026.09.23. Due dates apply to US federal civilian agencies; summaries are CISA’s.