September 2026 is not being kind to anyone who owns a patch calendar. Three separate stories landed within days of each other: a federal directive pushing forensic triage into a three-day window, a Linux kernel deadline that fell on a Sunday, and a macOS AI assistant that will happily send your dictated audio to whatever endpoint a random local process points it at.
Here is what actually happened, and what I would do about it.
Cisco SD-WAN: three years of nobody noticing
Rewind to February 26, 2026. Cisco disclosed CVE-2026-20127, an authentication bypass in the Catalyst SD-WAN peering authentication mechanism, rated CVSS 10.0. The threat actor tracked as UAT-8616 had been sitting inside victim networks since at least 2023.
The interesting part is not the zero-day. It is what came after.
Rather than hunting for a fresh privilege escalation, UAT-8616 deliberately downgraded target systems to software versions still vulnerable to CVE-2022-20775, a path traversal flaw Cisco patched back in September 2022. The path traversal gave them root. They created local accounts for persistence, then restored the original software version so routine monitoring would see nothing unusual.
Read that sequence again. The attacker used a four-year-old patch as the second stage of the chain. Every organization that assumed "we're on a supported version" was still exploitable, because the downgrade was the exploit.
CISA responded with Emergency Directive 26-03, requiring federal agencies to identify and patch affected systems within 24 hours. Initial identification and external log configuration by February 26, full patch deployment by 5 PM ET on February 27, then system inventories, threat hunting, and hardening through March 12. Both CVEs went into the Known Exploited Vulnerabilities catalog immediately.
The guidance that stuck with me: for any SD-WAN infrastructure showing compromise indicators, consider a full rebuild rather than in-place patching. With a three-year dwell time and undocumented persistence mechanisms, patching is not remediation. It is hope.
This is not an isolated Cisco problem either. Cisco patched CVE-2025-20393, another zero-day, exploited by a China-nexus group designated UAT-9686. Two different advanced actors, two different objectives, same vendor. If you run Cisco edge infrastructure, you are on somebody's target list.
BOD 26-04 meets the biggest Patch Tuesday on record
CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," on June 10, 2026. It revoked two earlier directives and replaced the old KEV-then-patch model with something more nuanced. Each vulnerability gets scored on four variables: is the asset publicly exposed, is it in the KEV catalog, can exploitation be automated, and does it yield partial or total system control. The worst combinations get three days. The mildest can wait for a scheduled upgrade.
The genuinely new requirement is forensic triage. Under BOD 22-01, closing a KEV entry meant applying the patch. Under BOD 26-04, the highest tier says agencies must "complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised." You have to figure out whether the attacker got in before you patched.
That theory met reality this month.
On September 18, CISA added CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 to the KEV catalog, three actively exploited Linux kernel flaws. Federal civilian agencies had until September 21, which was a Sunday. Linux runs federal cloud workloads, network appliances, container hosts, and embedded systems, many of them vendor-maintained. If the vendor has not shipped a patched kernel, you cannot fix it, and you still have to do the log review.
Then September 22 brought a second deadline: two Windows privilege escalation zero-days Microsoft disclosed on September 8. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call. CVE-2026-81963 is an improper link-resolution flaw in the Windows Update Stack. Both take an attacker who already has a foothold to SYSTEM. Because they need local access, CISA gave agencies 14 days instead of three.
That 14-day window sits on top of a release covering 974 CVEs. Microsoft fixed 723 Windows flaws, 222 in Office, 62 in SQL Server. For scale, The Register noted Microsoft shipped 1,130 CVEs across all of 2025. September alone covers most of a year.
The tiered model works better than I expected. CVE-2026-75650, the Adobe Commerce and Magento template injection flaw researchers call "StyleSmuggler," is remotely exploitable against internet-facing storefronts, so agencies had until September 11. The Windows local flaws got two weeks. And if you pull a vulnerable system off the public internet, its deadline extends, which is a legitimate way to buy time while waiting on a vendor.
Meta Muse: a hidden preference and a dictation hijack
Patrick Wardle, who runs Objective-See and wrote "The Art of Mac Malware," published a proof of concept on GitHub on September 21 called not-a-mused. It targets a preference inside Meta's Muse AI assistant for macOS named endo_voyager_dictation_endpoint. That setting controls where the app sends dictated audio and text.
It has no meaningful protection. Any process running as the logged-in user, with no elevation whatsoever, can rewrite it and redirect Muse's dictation traffic to an attacker-controlled server. Wardle's tool exposes 50+ commands Muse offers once you have local code execution.
No CVE has been assigned as of September 22. No Meta patch or advisory has surfaced in the coverage. Wardle's own recommendation was direct: do not install Muse.
What bothers me about this one is the target. We are bolting AI assistants onto the desktop with broad access to the microphone, files, and account tokens, and their internal configuration is apparently treated as an implementation detail rather than a security boundary. Muse does not need to be remotely exploitable to be a problem. It needs one piece of commodity malware to land under the user's account, and then your dictated prompts become someone else's input stream.
What to do this week
The Cisco campaign and the BOD 26-04 deadlines point at the same operational gap: we are good at shipping patches and bad at detecting whether anything happened first.
Practical steps, in rough priority order.
Inventory the SD-WAN estate and check for unexpected local accounts and anomalous NETCONF activity. If you find downgrade artifacts, rebuild.
Confirm kernel patch status on every publicly exposed Linux asset, including appliances. Where no patch exists, remove internet exposure and document why.
Write down your forensic triage. Not just "patched." Log review, integrity checks, timestamps, who did it. BOD 26-04 makes the triage the compliance artifact, not the patch.
Close the Windows ALPC and Update Stack zero-days before the September 22 deadline, prioritizing hosts where an attacker might already have a local foothold. The 14-day window is comfortable right up until someone is already inside.
And if Muse is deployed anywhere in your fleet, pull it until Meta says something. Silence after 24 hours of coverage across five outlets is its own kind of answer.