Three exploited Linux kernel vulnerabilities under active attack
The headline this morning is a warning about three Linux kernel vulnerabilities that are being exploited in the wild, flagged by SecurityWeek. If you run Linux hosts anywhere near your Microsoft estate, whether that is Defender-managed servers, container hosts, or appliances built on a Linux base, this is a patch-now item rather than a patch-eventually one. Exploited kernel flaws give attackers a fast path to privilege escalation once they have any foothold.
Pair that with the Gyazo breach reported by BleepingComputer, where a server flaw was exploited to steal 23.6 million user records. The theme for the day is that server-side flaws are being turned into exploitation and data theft quickly, so triage by what is actually being used against real targets.
KEV-listed critical CVEs still driving exploitation
No new CISA KEV additions landed since September 19, but the hot list is still dominated by KEV-listed, ransomware-linked criticals you should confirm are closed. SonicWall SMA1000 CVE-2026-15409, a server-side request forgery flaw, sits at CVSS 10 with an EPSS of roughly 0.85 and is both KEV listed and ransomware linked. WebPros cPanel and WHM CVE-2026-41940 carries a CVSS of 9.8 and an EPSS near 0.99, also KEV and ransomware linked.
Two Cisco criticals remain in play. CVE-2026-76461 is a SQL injection in Cisco Secure Email Gateway at CVSS 9.8, and CVE-2026-76460 is the Cisco Identity Services Engine privileged API flaw at CVSS 10 that Dark Reading covered as a zero-day highlighting API endpoint authentication weaknesses. Both are KEV listed. Oracle PeopleSoft PeopleTools CVE-2026-35273 and Palo Alto Networks PAN-OS CVE-2026-0257 round out the ransomware-linked, KEV-listed set with high EPSS scores. ConnectWise ScreenConnect CVE-2024-1708 and Meta React Server Components CVE-2025-55182 are also still on the exploited list.
If you are not certain which of these you have already patched, the Senserva non-Microsoft exploited-CVE tracker follows CISA KEV additions daily so you can check your exposure against the current list.
September Windows updates break File History and Excel
Microsoft admins have operational side effects to manage this cycle. BleepingComputer reports the September updates break the File History backup feature, so if you rely on File History for endpoint recovery, verify backups are still running before you assume they are. Microsoft has separately fixed broken Excel copy and paste for all Office users, which should resolve a workflow complaint many help desks have been fielding.
On the patch side, the top Windows rollups this cycle carry heavy CVE counts and are marked Critical. KB5046616 for Windows Server 2022 addresses 37 CVEs, and the Windows 10 Version 1809 rollups KB5046615, KB5046617, and KB5046612 cover 31, 33, and 27 CVEs respectively, all flagged as containing KEV-listed content. Do not defer these because of the File History issue; test and deploy while validating backup behavior.
Entra ID passkeys and Teams controls
Microsoft is reminding administrators to migrate Entra ID users to passkeys, per BleepingComputer. If you have been treating passkey rollout as a someday project, treat this as the nudge to build the migration plan now. Microsoft is also adding the ability for Teams admins to block custom file extensions, which gives you another lever against file-based delivery in chat.
Do this first
Work top down by exploitation risk, not by vendor convenience.
- Patch the three exploited Linux kernel vulnerabilities on any Linux hosts in scope, treating them as active-attack items.
- Confirm the KEV-listed, ransomware-linked edge criticals are closed: SonicWall CVE-2026-15409, cPanel CVE-2026-41940, PeopleSoft CVE-2026-35273, and PAN-OS CVE-2026-0257.
- Deploy the September Windows rollups, including KB5046616 for Server 2022, then verify File History backups still run afterward.
- Confirm the two Cisco criticals, CVE-2026-76461 and CVE-2026-76460, are remediated on Secure Email Gateway and ISE.
- Start or accelerate your Entra ID passkey migration and review the new Teams file-extension blocking option.
- Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by CISA KEV, EPSS, and ransomware linkage so this cycle's KBs get prioritized correctly.
Sources
- SecurityWeek: Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities (2026-09-21)
- BleepingComputer: Microsoft: September updates break File History backup feature (2026-09-21)
- BleepingComputer: Microsoft reminds admins to migrate Entra ID users to passkeys (2026-09-21)
- BleepingComputer: Microsoft fixes broken Excel copy and paste for all Office users (2026-09-21)
- Dark Reading: Cisco Zero-Day Highlights API Endpoint Authentication Issues (2026-09-18)
- BleepingComputer: Microsoft Teams will let admins block custom file extensions (2026-09-18)
- BleepingComputer: Gyazo server flaw exploited to steal 23.6 million user records (2026-09-18)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-21.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.