Morning Brief — 2026-09-17

2 material breach disclosures, 3 federal patching priority, 10 emerging critical cves, 10 supply chain, 26 ransomware activity, 860 ioc volume, 15 active malware families, 3 multi-source iocs, 2 intel feeds, 18 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Nutex Health Inc. (NUTX)

• Filed: 2026-09-11 · CIK 0001479681 · Accession 0001628280-26-061432
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026061432/materiality_assessmentxupd.htm

Forward-Looking StatementsCertain statements and information included in this press release constitute “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. When used in this press release, the words or phrases “will,” “will likely result,” “expected to,” “will continue,” “anticipated,” “estimate,” “projected,” “intend,” “goal,” or similar express…

BOSTON SCIENTIFIC CORP (BSX)

• Filed: 2026-09-08 · CIK 0000885725 · Accession 0000885725-26-000059
• Filing: https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

As previously disclosed in a Current Report on Form 8-K filed on August 26, 2026 with the Securities and Exchange Commission, on August 25, 2026, Boston Scientific Corporation (the “Company”) identified a cybersecurity incident that affected certain of its information technology systems and resulted in a global disruption to the Company’s operations. Upon detection, the Company activated its incid…

Federal Patching Priority

CVE-2026-58704 — Google Pixel

Google Pixel Improper Authorization Vulnerability

• Added: 2026-09-16 · Federal due: 2026-09-19 · EPSS 1.6th pct (score 0.001) · CVSS 8.8 (HIGH) · CWE-285, CWE-693
• ransomware use: Unknown

Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-76460 — Cisco Identity Services Engine

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

• Added: 2026-09-16 · Federal due: 2026-09-19 · CVSS 10.0 (CRITICAL) · CWE-648
• ransomware use: Unknown

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized…

CVE-2026-87886 — Acronis Backup

Acronis Backup Incorrect Default Permissions Vulnerability

• Added: 2026-09-16 · Federal due: 2026-09-19 · CWE-276
• ransomware use: Unknown

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.

Exploit Probability Movers

No CVEs with ≥0.20 EPSS movement in this window.

Emerging Critical CVEs

• CVE-2026-76423 · CRITICAL (10.0) · 2026-09-16 — A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device.

This vulnerability is due to the REST API web service…

• CVE-2026-20192 · CRITICAL (10.0) · 2026-09-16 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensiv…
• CVE-2026-20130 · CRITICAL (10.0) · 2026-09-16 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensi…
• CVE-2026-73456 · CRITICAL (10.0) · 2026-09-16 — Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code exec…
• CVE-2026-70416 · CRITICAL (10.0) · 2026-09-16 — Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote exec…
• CVE-2026-73453 · CRITICAL (10.0) · 2026-09-16 — An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Ru…
• CVE-2026-20332 · CRITICAL (9.9) · 2026-09-16 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management C…
• CVE-2026-20330 · CRITICAL (9.9) · 2026-09-16 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management C…
• CVE-2026-20329 · CRITICAL (9.9) · 2026-09-16 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management C…
• CVE-2026-20325 · CRITICAL (9.9) · 2026-09-16 — As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software…

Supply Chain

GHSA-mxm6-v9r6-r94c · CVE-2026-63671 (npm)

• HIGH · CVSS 8.1 · 2026-09-16
• Affected: @nuxtjs/mdc
• https://github.com/advisories/GHSA-mxm6-v9r6-r94c

@nuxtjs/mdc’s URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

GHSA-9pj6-vhgr-3mwh · CVE-2026-63128 (rust)

• HIGH · CVSS 7.5 · 2026-09-16
• Affected: rmcp
• https://github.com/advisories/GHSA-9pj6-vhgr-3mwh

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

GHSA-33f5-2c5q-wgwj · CVE-2026-63127 (rust)

• HIGH · CVSS 8.2 · 2026-09-16
• Affected: rmcp
• https://github.com/advisories/GHSA-33f5-2c5q-wgwj

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

GHSA-7prp-2623-8g45 · CVE-2026-61599 (pip)

• HIGH · 2026-09-16
• Affected: djust
• https://github.com/advisories/GHSA-7prp-2623-8g45

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

GHSA-c7c5-5j6r-q957 · CVE-2026-61596 (pip)

• HIGH · CVSS 7.1 · 2026-09-16
• Affected: djust
• https://github.com/advisories/GHSA-c7c5-5j6r-q957

djust has broken object-level access control (IDOR)

GHSA-xhhm-f6hp-2qwj · CVE-2026-61594 (pip)

• CRITICAL · CVSS 9.1 · 2026-09-16
• Affected: djust
• https://github.com/advisories/GHSA-xhhm-f6hp-2qwj

djust has an authorization bypass on the WebSocket/SSE mount path

GHSA-c67v-vqrp-m5wj · CVE-2026-61591 (pip)

• HIGH · CVSS 8.1 · 2026-09-16
• Affected: djust
• https://github.com/advisories/GHSA-c67v-vqrp-m5wj

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

GHSA-f795-p5jw-j6g2 · CVE-2026-61592 (pip)

• HIGH · CVSS 7.4 · 2026-09-16
• Affected: djust
• https://github.com/advisories/GHSA-f795-p5jw-j6g2

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

GHSA-r2pf-9cw4-5j65 · CVE-2026-68904 (npm)

• HIGH · CVSS 7.0 · 2026-09-16
• Affected: node-opcua-transport, node-opcua-client, node-opcua
• https://github.com/advisories/GHSA-r2pf-9cw4-5j65

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

GHSA-pg97-jvmf-qfvc · CVE-2026-61593 (pip)

• HIGH · CVSS 8.1 · 2026-09-16
• Affected: djust
• https://github.com/advisories/GHSA-pg97-jvmf-qfvc

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

Ransomware Activity

26 new victim postings across 13 groups.

IOC Volume

860 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

15 malware families active this week (0 corroborated across ≥2 sources), exercising 19 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, Amadey, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

3 IOCs flagged by 2+ independent sources this window — the highest-confidence signal the cross-feed corpus produces.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (3,418 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

16 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 160 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.