Morning Brief — 2026-09-23

1 material breach disclosures, 4 federal patching priority, 20 exploit probability movers, 10 emerging critical cves, 10 supply chain, 32 ransomware activity, 880 ioc volume, 13 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Nutex Health Inc. (NUTX)

• Filed: 2026-09-11 · CIK 0001479681 · Accession 0001628280-26-061432
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026061432/materiality_assessmentxupd.htm

Forward-Looking StatementsCertain statements and information included in this press release constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. When used in this press release, the words or phrases “will,” “will likely result,” “expected to,” “will continue,” “anticipated,” “estimate,” “projected,” “intend,” “goal,” or similar express…

Federal Patching Priority

CVE-2026-93952 — Arista VeloCloud Orchestrator

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

• Added: 2026-09-22 · Federal due: 2026-09-25 · EPSS 36.3th pct (score 0.004) · CVSS 10.0 (CRITICAL) · CWE-20
• ransomware use: Unknown

Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been…

CVE-2026-85102 — Check Point Multiple Products

Check Point Multiple Products Improper Certificate Validation Vulnerability

• Added: 2026-09-22 · Federal due: 2026-09-25 · EPSS 26.3th pct (score 0.003) · CVSS 9.8 (CRITICAL) · CWE-295
• ransomware use: Unknown

Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

CVE-2026-94127 — F5 BIG-IP APM

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

• Added: 2026-09-22 · Federal due: 2026-09-25 · CVSS 9.8 (CRITICAL) · CWE-122
• ransomware use: Unknown

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected…

CVE-2026-93616 — Check Point Multiple Products

Check Point Multiple Products Path Traversal Vulnerability

• Added: 2026-09-22 · Federal due: 2026-09-25 · CVSS 9.8 (CRITICAL) · CWE-22
• ransomware use: Unknown

Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-96257 · CRITICAL (10.0) · 2026-09-23 — A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer ove…
• CVE-2026-75745 · CRITICAL (10.0) · 2026-09-22 — Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to…
• CVE-2026-89275 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e…
• CVE-2026-84412 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e…
• CVE-2026-77244 · CRITICAL (10.0) · 2026-09-22 — MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher constructi…
• CVE-2026-75723 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execu…
• CVE-2026-75721 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e…
• CVE-2026-75703 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e…
• CVE-2026-75699 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e…
• CVE-2026-73369 · CRITICAL (10.0) · 2026-09-22 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code (‘Code Injection’) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e…

Supply Chain

GHSA-wx4m-69m9-gx3m · CVE-2026-91130 (pip)

• CRITICAL · 2026-09-22
• Affected: homeassistant
• https://github.com/advisories/GHSA-wx4m-69m9-gx3m

Home Assistant: XSS in Statistics Graph Card

GHSA-xj3h-wwxq-gfcj · CVE-2026-77633 (go)

• HIGH · CVSS 7.1 · 2026-09-22
• Affected: github.com/cloudreve/Cloudreve/v4
• https://github.com/advisories/GHSA-xj3h-wwxq-gfcj

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

GHSA-4825-p4xm-pcf2 · CVE-2026-94462 (rubygems)

• HIGH · CVSS 7.1 · 2026-09-22
• Affected: spree_api, spree_api
• https://github.com/advisories/GHSA-4825-p4xm-pcf2

Spree: Broken Access Control in PATCH /api/v3/store/carts/:id/associate (IDOR)

GHSA-vv3m-f8x4-7377 · CVE-2026-85740 (pip)

• HIGH · CVSS 7.1 · 2026-09-22
• Affected: lightrag-hku
• https://github.com/advisories/GHSA-vv3m-f8x4-7377

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

GHSA-frch-4w6v-q5xx · CVE-2026-85734 (pip)

• CRITICAL · CVSS 9.1 · 2026-09-22
• Affected: lightrag-hku
• https://github.com/advisories/GHSA-frch-4w6v-q5xx

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

GHSA-vxg7-f2jj-jmqm · CVE-2026-76819 (go)

• HIGH · CVSS 8.6 · 2026-09-22
• Affected: github.com/projectdiscovery/nuclei/v3
• https://github.com/advisories/GHSA-vxg7-f2jj-jmqm

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

GHSA-328g-jx67-v94g · CVE-2026-77560 (go)

• HIGH · CVSS 8.1 · 2026-09-22
• Affected: github.com/tinyauthapp/tinyauth
• https://github.com/advisories/GHSA-328g-jx67-v94g

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

GHSA-5jpj-293f-rhvj · CVE-2026-62371 (go)

• HIGH · CVSS 8.8 · 2026-09-22
• Affected: github.com/kubeedge/kubeedge, github.com/kubeedge/kubeedge, github.com/kubeedge/kubeedge
• https://github.com/advisories/GHSA-5jpj-293f-rhvj

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

GHSA-9vm9-pqxx-x83v · CVE-2026-62369 (go)

• HIGH · CVSS 8.1 · 2026-09-22
• Affected: github.com/kubeedge/kubeedge, github.com/kubeedge/kubeedge, github.com/kubeedge/kubeedge
• https://github.com/advisories/GHSA-9vm9-pqxx-x83v

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

GHSA-34fc-gh42-pj53 · CVE-2026-63132 (go)

• CRITICAL · 2026-09-22
• Affected: github.com/openbao/openbao, github.com/openbao/openbao
• https://github.com/advisories/GHSA-34fc-gh42-pj53

OpenBao’s Recovery Mode Vulnerable To Token Leakage via Timing Attack

Ransomware Activity

32 new victim postings across 13 groups.

IOC Volume

880 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

13 malware families active this week (1 corroborated across ≥2 sources), exercising 17 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, ClearFake). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (4,233 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.