IT Daily Roundup – September 23, 2026
1. Zyxel GS1900 and Veeam Agent for Windows – Actively Exploited Vulnerabilities, CISA Deadline Tomorrow
CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog with a patching deadline of September 24, 2026. The first affects Zyxel GS1900 managed switches: CVE-2026-7273 (CVSS 8.8) is a stack-based buffer overflow in the CGI program that allows an unauthenticated, LAN-based attacker to execute arbitrary OS commands via a crafted HTTP request. All GS1900 series models are affected (GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48, 48HPv2) running firmware versions prior to the June 2026 patches — updates are available for all affected models. The second vulnerability is CVE-2026-32996 (CVSS 7.3) in Veeam Agent for Microsoft Windows: an attacker with local access can read session UIDs from the log file C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log and abuse them to gain SYSTEM-level privileges. Security firm Arctic Wolf reports active exploitation in the wild, with a public proof-of-concept available on GitHub.
Why this matters: The Zyxel GS1900 is a popular low-cost managed switch series widely deployed in SME office networks, while Veeam Agent for Windows is one of the most widely used backup solutions for Windows workstations and servers in small businesses. The combination of these two actively exploited vulnerabilities makes one thing clear: attackers are targeting standard SME infrastructure, not just enterprise systems. With CISA's deadline tomorrow, organizations should immediately verify firmware versions on network switches and update Veeam Agent on all Windows devices. If your IT provider manages network infrastructure, contact them today and request confirmation that patches have been applied.
2. EvilTokens – Phishing-as-a-Service Platform Dismantled After Compromising 12,000 Microsoft 365 Accounts
Microsoft's Digital Crimes Unit, working with UK law enforcement, disrupted the EvilTokens phishing-as-a-service (PhaaS) platform on September 22, 2026. Active since February 2026 and sold via Telegram for $500/month or $1,500 as a one-time fee, the platform compromised over 12,000 Microsoft 365 accounts across more than 10,000 organizations worldwide (SpyCloud data: 8,708 accounts across 6,585 corporate email domains in 79 countries). EvilTokens' key capability was MFA bypass: it exploited Microsoft's legitimate OAuth 2.0 device-code flow — a feature designed for input-limited devices such as smart TVs. Attackers generated a device code and sent it to victims via phishing; when the victim entered the code on Microsoft's authentic login page, attackers received a valid authentication token without ever needing the victim's password or MFA code. Post-compromise, the platform used AI to analyze mailbox content, identify wire transfer instructions, and map high-value targets in organizational hierarchies. Two suspected administrators were arrested in the UK, but clones of the platform (such as APToken) are already emerging.
Why this matters: EvilTokens bypassed MFA for months — not through a software vulnerability, but by abusing a legitimate Microsoft feature designed for low-input devices. For SMEs using Microsoft 365, the recommendations are concrete: disable device-code authentication for regular users via Azure AD / Microsoft Entra ID (Conditional Access policy "Block device code flow"), deploy FIDO2 security keys or passkeys for administrators, and regularly review Azure AD Sign-in Logs for unfamiliar applications or unusual login locations. MFA remains essential — but it must be properly configured to be effective.
3. D-Link DIR-822A – Critical Zero-Day with No Patch Available and Public Exploit Code
D-Link has warned of a critical zero-day vulnerability CVE-2026-86296 (maximum severity) in DIR-822A dual-band Wi-Fi routers. The flaw is a stack-based buffer overflow in the DHCP server component: a specially crafted request causes a buffer overflow via the strcpy function, potentially crashing the DHCP daemon or enabling arbitrary code execution. The attack requires no authentication and can be launched from the local network. No patch is currently available; D-Link is still investigating. The situation is aggravated by the public availability of a proof-of-concept exploit, which significantly shortens the window before mass exploitation begins. A second vulnerability in the same model (CVE-2026-86510) is also under investigation. D-Link recommends disabling remote management and restricting administrative access to trusted devices only.
← All postsWhy this matters: The D-Link DIR-822A is an older but still commonly deployed router in small offices and home offices of remote employees. Since no patch exists and public exploit code is freely available, the only available protection is isolation: disable remote management, restrict router admin access to specific trusted devices, and seriously consider replacing the unit with a supported model. This situation illustrates a persistent problem with legacy networking equipment: the vendor stops issuing patches (or is very slow to do so) and the device remains permanently vulnerable. If your IT provider manages network infrastructure or employee home office setups, now is a good time to audit which routers are in use and when they last received a firmware update.