Security Roundup September 2026: cPanel, MikroTik, Citrix and the Biggest Patch Tuesday Yet

September 2026 opened with a BGP hijack that passed RPKI and closed with Citrix NetScaler zero-days exploited worldwide. In between, hosting panels, MikroTik routers, VPN gateways and webmail were all targeted, and Microsoft shipped its largest Patch Tuesday to date.

Here is what matters most for businesses and server operators in Indonesia.

This month’s priorities

Product	Flaw	Status	Action
cPanel & WHM	CVE-2026-87899	Any hosting account can run code as root	Update to the latest build
MikroTik RouterOS	CVE-2026-67277, CVE-2026-86060	Exploited, routers taken over without login	Update per MikroTik’s advisory
Windows	CVE-2026-81963, CVE-2026-85880	Two exploited zero-days	Install the September updates
Citrix NetScaler	CVE-2026-88771, CVE-2026-88772	Mass exploitation, unauthenticated root	Update and check for compromise
Check Point Gateway	CVE-2026-85102	Exploited since 12 September	Apply the hotfix
Roundcube	CVE-2026-48842	Exploited	Update to 1.6.16 or 1.7.1

cPanel: an ordinary hosting account can become root

On 22 September cPanel fixed CVE-2026-87899, a flaw in the CalDAV/CardDAV feature that lets any cPanel account run code as root. cPanel describes the impact as “full control of the server”. The same release fixed CVE-2026-68490 (reading other accounts’ calendars and contacts) and CVE-2026-87900 in WP Toolkit (modifying other accounts’ databases).

Fixes are in cPanel & WHM 11.134.0.57, 11.136.0.41 and 11.138.0.8, and WP Toolkit 6.11.3. No exploitation had been reported as of 23 September, but the flaw is very dangerous on shared servers. cPanel shipped another patch on 29 September.

Action: run /usr/local/cpanel/scripts/upcp --force and update WP Toolkit. There is no workaround, so prioritise multi-tenant servers.

Acronis backup plugin for cPanel and Plesk

Acronis confirmed limited exploitation of CVE-2026-87886 (CVSS 7.8), a local privilege escalation in the Acronis backup plugin for cPanel/WHM and the extension for Plesk. The confirmation is based on a single customer report, and no indicators of compromise have been published.

• cPanel & WHM plugin builds before 1.9.3.1021: update to 1.9.3 HF3.
• Plesk extension builds before 1.8.11.638: update to 1.8.11.

Action: update immediately, especially on shared hosting servers. Restrict shell access for untrusted accounts until the patch is in place. Cloudku Cyber Protection customers using this plugin on cPanel or Plesk servers can contact our team to confirm their version is safe.

MikroTik RouterOS: “MikroTrick”

CERT Polska reported MikroTik routers being taken over without authentication through a chain of two flaws, which CISA named “MikroTrick”:

• CVE-2026-67277 (CVSS 8.8): missing authentication in the btest service, leading to a kernel memory leak and DoS.
• CVE-2026-86060 (CVSS 9.2): a policy-mask change that leads to privilege escalation.

CISA added both to the KEV catalog on 10–11 September. MikroTik is extremely common among Indonesian ISPs and businesses, so this deserves special attention.

Action: update RouterOS per MikroTik’s advisory. Disable or restrict the btest service, and limit management access (Winbox, WebFig, SSH) to trusted IPs only.

The same KEV batch included ScreenConnect CVE-2026-84869 (CVSS 9.9, fixed in 26.6.5) and two JFrog Artifactory flaws.

September Patch Tuesday: a record release

Microsoft fixed more than 960 flaws on 8 September, the largest Patch Tuesday on record at the time. Two zero-days were already exploited:

• CVE-2026-81963: privilege escalation to SYSTEM through the Windows Update Stack.
• CVE-2026-85880: a heap overflow in Windows ALPC that allows escape from the AppContainer sandbox to SYSTEM.

Both need local access first, so defences against phishing and credential theft still matter.

Action: install the September updates on every Windows and Windows Server system.

VPN gateways: Citrix, Check Point and Cisco

• Citrix NetScaler, CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5). CISA confirmed global exploitation on 27 September. watchTowr demonstrated unauthenticated code execution as root, and Unit 42 counted more than 50,000 exposed appliances. Fixed in 14.1-73.37 and 13.1-64.23. If there are signs of compromise, isolate the appliance, rebuild it, rotate all credentials and replace certificates.
• Check Point Security Gateway, CVE-2026-85102. Unauthenticated code execution through VPN certificate handling, exploited since 12 September. Apply the LivePatch or Jumbo Hotfix, or restrict site-to-site VPN on UDP/500 and UDP/4500 to known peer IPs.
• Cisco. Three products were exploited: Firepower Management Center (CVE-2026-20079 and CVE-2026-20316, used among others by a Qilin ransomware operator), Secure Email Gateway (CVE-2026-76461, CVSS 9.8) and ISE (CVE-2026-76460, CVSS 10.0). Patch all three and keep management interfaces off the internet.

Roundcube: webmail on hosting servers

CVE-2026-48842 (CVSS 8.1) is an unauthenticated SQL injection in Roundcube’s virtuser_query plugin that can expose mailbox credentials and messages. Patches have existed since May, yet Shadowserver sees more than 523,000 exposed Roundcube instances. Update to 1.6.16 or 1.7.1.

Backup and switches: Veeam and Zyxel

• Veeam Agent for Windows, CVE-2026-32996 (CVSS 7.3): local privilege escalation to SYSTEM, exploited, with a public PoC. Update per Veeam’s advisory.
• Zyxel GS1900, CVE-2026-7273 (CVSS 8.8): 996 switches in 48 countries taken over since 17 August. Update the firmware and rotate root credentials.

BGP: a hijack that passed RPKI

From 28 to 30 August, Hetzner’s prefix 162.55.80.0/24 was hijacked over BGP. The bogus route was RPKI valid because the ROA allowed announcements down to /24. The attacker then served a malicious Virtualizor update to a small number of installations. The case was disclosed on 1 September, and APNIC published recommendations for network operators on 22 September.

We covered it in depth, including a checklist for prefix holders, in An RPKI-Valid BGP Hijack.

Data leaks in the region

• 220 million airline passenger records. An Elasticsearch database of Advance Passenger Information (names, dates of birth, passport numbers, flights) from 2017 to April 2026 was reachable with default credentials. It was hosted on Viettel’s network in Hanoi; the operator has not been confirmed.
• Japan’s Digital Agency. Attackers used a VPN flaw that already had a patch (medium severity, not a zero-day) to reach a shared platform linking 23 ministries. About 246,000 records may have leaked.

The lessons are simple: never leave a database with default credentials, and patch VPN flaws even when they are rated “medium”.

DDoS: a booter service taken down

The FBI and Canadian police seized the domains of NightmareStresser, one of the longest-running DDoS-for-hire services, used in hundreds of thousands of attacks since 2022. No new record-size attack was reported in September.

In Indonesia: the PDP agency and PP 33/2026

The Ministry of Communication and Digital Affairs (Komdigi) said it is speeding up the creation of the Personal Data Protection Agency. A draft presidential regulation has been submitted for signature, and Komdigi supervises in the meantime. PP 33/2026 takes effect on 16 January 2027, with obligations including records of processing, DPIAs, a data protection officer in certain cases, and incident notification within 3 x 24 hours.

See our full guide to PP 33/2026.

Quick checklist

1. Update cPanel & WHM, WP Toolkit and backup plugins on your hosting panels.
2. Update RouterOS and restrict MikroTik management access.
3. Install September Patch Tuesday.
4. Update NetScaler, Check Point and any Cisco products you run.
5. Update Roundcube and Veeam Agent.
6. Review your ROAs if you announce your own IP space.
7. Start preparing for PP 33/2026 compliance.

How Cloudku can help

Many of this month’s attacks started at edge devices and hosting panels that were patched too late. When a server is breached, a separate backup is the fastest way back. Cloudku Cyber Protection keeps backups outside your servers and adds anti-malware protection. For IP holders, the prefixes announced through Cloudku IP Transit are registered in IRR and validated with RPKI. Make sure your ROAs use a strict maxLength before your BGP session goes live.