Checklist
SIM swap: the first hour
Containment and verification steps when a customer’s number may have been hijacked.
Desk 04For Security engineers
The security engineering desk
What’s being exploited this week, and the identity signals worth wiring into detection.
For security engineers and soc teams.
What matters now
CISA’s Known Exploited Vulnerabilities catalog is the list federal agencies must patch against; each Wednesday Briefing lists the week’s additions.
Briefing: The Wednesday Briefing No. 7A carrier SIM-change check before trusting a phone number is one of the most direct account-takeover signals available.
Buyer’s guide: SIM swap detection: a buyer’s guideAdministrators and other high-risk users should get device-bound credentials, not synced passkeys.
Buyer’s guide: Phishing-resistant MFA: a buyer’s guide
Your reading path
Start at the top. Each step builds on the last.
Start here · Briefing
The Wednesday Briefing No. 7
Start here: this week’s exploited vulnerabilities and identity news.
Then · Field guide
SIM swap incident response: the first hour and the first week
Containment steps for a hijacked phone number.
Then · Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
What to require for admins and high-risk staff.
Then · Explainer
Carrier-native authentication, explained: how a SIM can sign a login
What carrier signals can and can’t prove.
Exploited, most recently
The latest additions to CISA’s KEV catalog.
| CVE | Vendor and product | Vulnerability | Added | Due (federal) | Ransomware use |
|---|---|---|---|---|---|
| CVE-2026-94127 | F5 BIG-IP APM | F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCISA summaryF5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. | Unknown | ||
| CVE-2026-93952 | Arista VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCISA summaryArista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. | Unknown | ||
| CVE-2026-93616 | Check Point Multiple Products | Check Point Multiple Products Path Traversal VulnerabilityCISA summaryCheck Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. | Unknown | ||
| CVE-2026-85102 | Check Point Multiple Products | Check Point Multiple Products Improper Certificate Validation VulnerabilityCISA summaryCheck Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. | Unknown | ||
| CVE-2026-7273 | Zyxel GS1900 Series Switches | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityCISA summaryZyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. | Unknown | ||
| CVE-2026-53266 | Linux Kernel | Linux Kernel Out-of-Bounds Write VulnerabilityCISA summaryLinux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. | Unknown | ||
| CVE-2025-39964 | Linux Kernel | Linux Kernel Race Condition VulnerabilityCISA summaryLinux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. | Unknown | ||
| CVE-2025-39682 | Linux Kernel | Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityCISA summaryLinux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. | Unknown |
Source: CISA Known Exploited Vulnerabilities catalog, version 2026.09.23. Full weekly lists in the briefing archive.
Checklists for this desk
Checklist
Passkey launch readiness
What to settle before offering passkeys to customers or staff.
Rules that apply
Markets most relevant to this desk. Every row links to its primary source.
| Market | Regulator | Measure | Timing | Status | Primary source |
|---|---|---|---|---|---|
| United States | NIST | SP 800-63B-4: SMS OTP is a "restricted" authenticator | Final 2025 | Guidance | SP 800-63B-4: Authentication and Authenticator Management (NIST) |
Quick answers
How can banks stop OTP bot attacks?
The durable fix is to remove the code the bot asks for, using passkeys, in-app approval on a registered device or network-based verification. While codes remain, say in every message what the code approves and that the bank will never ask for it, and treat a new-device sign-in during an inbound call as a strong fraud signal.
How should a bank roll out passkeys to its customers?
Decide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.
How should a bank respond to a suspected SIM swap?
Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
What counts as phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guides and vendor briefs
Approaches, evaluation criteria and pre-pilot questions. No rankings; owner interest disclosed.
Buyer’s guide
Phishing-resistant MFA: a buyer’s guide
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guide
SIM swap detection: a buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Owner-affiliated vendor brief
Evaluating Glide Identity: what each desk should ask before a pilot
The Security engineers question set, then the pilot plan and who owns each step. No scores or recommendations.