The MSP Security Gap
The vendor was breached. The password too.
The scenario:
A property management company got the email every business dreads. A software vendor they used for tenant applications had been breached. Names, emails, and hashed passwords were exposed.
The property manager read it, felt briefly uneasy, and moved on, because the breach was the vendor's problem, not theirs.
How it unfolds:
One of the property management company's staff had used the same password for that vendor's portal as for the company's primary email account, a habit formed years earlier and never broken.
Three weeks after the breach notice went out, an attacker working through the leaked credential list found the reused password worked on the company's email login too. Nobody had forced a reset when the notice landed, so the door stayed open the whole time.
From there, they set up a forwarding rule on the mailbox and quietly monitored incoming wire transfer requests for the better part of a month before acting on one.
The warning signs:
A breach notification from any third-party vendor a staff member has an account with, even one that seems unrelated to core business systems
A new mail forwarding rule appearing on an account that the user did not set up themselves
Login activity on a business account from a location or device pattern that does not match the user's normal behavior
Stop it:
Require unique passwords for every system through a password manager, since password reuse is what turns someone else's breach into your incident
Force a password reset and MFA re-enrollment company-wide whenever a staff member reports being part of an unrelated third-party breach
Regularly audit mailbox rules across the organization for unexpected forwarding, particularly to external domains
-
P.S. A vendor's breach notice reads like someone else's problem right up until a password gets reused. The gap between "not our breach" and "our incident" is usually exactly one shared password. Identity monitoring that flags credential reuse and unusual mailbox activity together, rather than treating email security and access management as separate problems, is what catches it.
Patch first this week:
Four entries this week. Three of them sit on the edge of a client network, where an attacker needs no password to get started. Here is what to check across your client base.
Check Point Quantum gateways and management servers: two flaws, one advisory
Product: Check Point Quantum Security Gateway and Check Point Security Management Server.
Who runs it: mid-market clients with Check Point firewalls and site-to-site or remote access VPN, plus any client whose previous provider installed Check Point and left it running.
The action: install the latest Jumbo Hotfix on every gateway and every management server, following Check Point advisories sk1000117 and sk1000171. Gateways on R82.10 Take 43 or below, R82 Take 125 or below, or R81.20 Take 165 or below are exposed. Management servers on R81.10, R81 and anything in the R80 family are end of support and still affected, so those need an upgrade plan, not a hotfix. Then review the management server for scripts or files nobody put there.
The urgency: CVE-2026-85102 lets an unauthenticated attacker run code on the gateway through a certificate validation flaw in VPN negotiation. CVE-2026-93616 lets an unauthenticated attacker upload and run scripts on the management server. Both are rated CVSS 9.8 by Check Point. CISA added both to the Known Exploited Vulnerabilities catalog on September 22 with a federal deadline of September 25, which has already passed by the time this email lands. The management server holds the policy for every gateway it controls, so an unpatched one should be checked for compromise before it is patched.
F5 BIG-IP APM: remote code execution when APM acts as an OAuth server
Product: F5 BIG-IP Access Policy Manager, the remote access and single sign-on module on BIG-IP appliances.
Who runs it: larger clients with F5 load balancers, especially those that publish internal apps or VPN access through BIG-IP.
The action: first confirm whether any client has APM configured as an OAuth Authorization Server. Only that setup is affected. If it is, apply the engineering hotfix named in F5 article K000162605 for your branch (17.1, 17.5 or 21.1). Appliance mode does not protect you.
The urgency: CVE-2026-94127 is a heap-based buffer overflow that lets an unauthenticated attacker run code through crafted traffic. F5 rates it CVSS 9.8 (9.3 under CVSS v4). CISA added it to the KEV catalog on September 22 with a federal deadline of September 25, now passed. BIG-IP sits in front of the apps it protects, which makes it one of the first boxes attackers go looking for.
Cisco Identity Services Engine: an API that skips authentication
Product: Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector, the network access control platform that decides which users and devices get onto the network.
Who runs it: mid-market and enterprise clients with Cisco switching and wireless, and anyone using 802.1X or guest access policies built on ISE.
The action: apply the fixed release named in Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5. Affected builds span ISE 3.1 through 3.5, including recent patch levels, so do not assume a recently patched box is safe. Restrict the ISE management interface to a management network while you work through it.
The urgency: CVE-2026-76460 is rated CVSS 10.0 by Cisco. A crafted request to an API endpoint lets an unauthenticated remote attacker bypass the web management login. Control of ISE means control over who is trusted on the network. CISA added it to the KEV catalog on September 16 with a federal deadline of September 19, now more than a week behind us.
Zyxel GS1900 switches: crafted web requests from inside the LAN
Product: Zyxel GS1900 series smart managed switches, including the 8, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2 models.
Who runs it: small offices, retail sites and branch locations. These are the budget switches that go into a comms cupboard and are rarely touched again.
The action: update firmware to the 2.90 patch 2 build for your model, for example 2.90(AAHH.2)C0 on the GS1900-8, or later. Anything on 2.90 patch 1 or earlier is affected. Make sure the switch web interface is only reachable from a management VLAN, not from user or guest networks.
The urgency: CVE-2026-7273 is a stack-based buffer overflow in the switch web interface, rated CVSS 8.8 by Zyxel. An unauthenticated attacker on the same network can run operating system commands. Zyxel published the fix in June, but CISA only confirmed exploitation and added it to the KEV catalog on September 21, with a federal deadline of September 24 that has now passed. An attacker who has landed on one laptop can use this to own the switch every other device plugs into.