The Emirates are a target. Your business does not have to be a victim.
More than 600,000 attack attempts hit the UAE every day. No business can defend everything at once, and the ones that stay safe do not try to. They know exactly what they hold, what threatens it, and what to fix first. That picture is what this page, and our CDPA-aligned risk assessments, exist to give you.
Four days, four tools your IT provider or your developers lean on every day, and every one of them listed as exploited before most teams had read the advisory: the Cisco email gateway that opens your mail first, the GitLab server that holds the build keys, the ScreenConnect client that fixes your laptop from across town, and an Artifactory chain built from two bugs nobody rushed because neither looked critical alone. The fifth item is a phone call, not a patch: a caller from "IT" who walks an executive through registering a passkey on a page the attacker owns. Same lesson as every week. Management interfaces off the internet, tokens rotated after a patch, and one sentence the front desk can repeat. Tuesday added a reminder that the July vCenter bug is now ransomware territory, a WooCommerce wholesale form that takes PHP, and a Windows update that broke Remote Desktop, which is a reason to roll forward, not back. Wednesday closed the week with the supply chain in miniature: a paid WordPress plugin served from the developer's own site with a web shell inside, a hosting-panel backup plugin used to climb to root, and a Pixel modem bug that went from targeted use to the exploited list in a day. Thursday brought the second Cisco root-level zero-day in three days, this time in the ISE appliance that decides who gets on the network, and a first-hand account from the UAE cyber chief of a ransom call for more than $5 million after a company's data was destroyed and leaked. Friday added two more phone-and-firewall items: an open-source PBX whose API key is the same on every install and has been abused since 9 September, and a fifth pre-login bug in the Check Point management server since July, not yet exploited, with the July one as the reason not to wait. Read the five picks and get back to work.
Act todayVulnerabilities and exploits
An email arrives, the mail filter reads it, and the attacker is root on the filter
Cisco published advisory cisco-sa-esa-inj-2bLVGmhX on 14 September for CVE-2026-76461, a 9.8-rated SQL injection in the email parsing of AsyncOS for Secure Email Gateway that lets an unauthenticated remote attacker run commands as root by sending a crafted message through the appliance; the flaw was found during a TAC support case and Cisco PSIRT confirms it has been exploited in September. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Fixed releases are 15.5.5-0141, 16.0.4-3021 and 16.5.0-780 (Cisco recommends 16.5.0-780), there is no workaround, every physical and virtual Secure Email Gateway is affected regardless of configuration, and Cisco says it has already upgraded all Secure Email Cloud devices and contacted the cloud customers where it found indicators of compromise.
The Cyber Expert’s read.The email gateway is built to open every message before anyone else does, so a bug in its parser is a bug anyone on the internet can reach with a single send. The check Cisco gives is short: grep the mail_logs for a COPY statement that ends in TO PROGRAM. Because the attacker lands as root, treat a clean log as a hint rather than a verdict and read your firewall logs for the appliance talking to places it never did before. If the box is virtual and you have any doubt, Cisco's advice is to rebuild it from a fixed image and renew every certificate and credential it held, and that is the advice we would give too.
Who this touches:Any organization that runs a Cisco Secure Email Gateway (formerly IronPort or ESA) on premises or as a virtual appliance, and the managed providers who operate them for clients.
Strengthen
CIS 7 Continuous Vulnerability Management
CIS 9 Email and Web Browser Protections
CIS 12 Network Infrastructure Management
CIS 8 Audit Log Management
CIS 3 Data Protection
Do this week
1.Upgrade every Secure Email Gateway to 16.5.0-780 (or the fixed build for your branch) this week; there is no workaround, so the patch is the whole plan.
2.Run grep -i "COPY.*TO PROGRAM" against mail_logs on every appliance and cluster member, then check firewall logs for unexpected outbound connections from the gateway.
3.If anything looks wrong on a virtual appliance, preserve the logs, deploy a fresh fixed image, rebuild the configuration and rotate certificates and admin credentials; on a physical unit open a TAC case. Keep the management interface off the internet and turn DLP rules back on after the rebuild so outbound mail policy survives the change.
GlobalUnited StatesUK and EuropeMiddle EastEvery businessHealthcareFinancial servicesProfessional servicesManufacturingEmail and messagesPasswords and credentialsCisco Secure Email GatewayCisco AsyncOS
One request, no login, and the GitLab server hands over its secrets file by file
GitLab shipped patch releases 19.1.8, 19.2.6 and 19.3.2 on 10 September for CVE-2026-85706, a 10.0-rated path traversal in the repository commits API that lets an unauthenticated user read arbitrary files from a self-managed Community or Enterprise Edition server, exposing SSH keys, database credentials, deploy tokens and CI/CD variables; all versions from 18.7 onward are affected and GitLab.com and GitLab Dedicated were already patched. watchTowr saw in-the-wild probes on 11 September, one day after disclosure, and CISA added the CVE to the KEV catalog that day with a 14 September deadline for federal agencies. The same release fixes 17 other bugs, including a 9.9-rated deserialization flaw (CVE-2026-87719) that is not yet known to be exploited.
The Cyber Expert’s read.A source-code server holds more than source code. It holds the keys to the build pipeline, and whatever leaves the pipeline is trusted by every server downstream, which is why a read-only bug here is not a read-only problem. The hunt is simple: look in the access logs for POST requests to /api/v4/projects/<id>/repository/commits/ that carry a file.path parameter. If you find one, assume the tokens on that box are already in circulation and rotate them, because patching the server does not un-read the file.
Who this touches:Software teams and any business running a self-managed GitLab instance, plus the software vendors and contractors who build for you on theirs.
Strengthen
CIS 7 Continuous Vulnerability Management
CIS 16 Application Software Security
CIS 5 Account Management
CIS 8 Audit Log Management
CIS 12 Network Infrastructure Management
Do this week
1.Upgrade self-managed GitLab to 19.1.8, 19.2.6 or 19.3.2 now; single-node installs will have a short outage while the database migrations run, so schedule it today rather than next sprint.
2.Search the access logs for POST /api/v4/projects/*/repository/commits/ with file.path in the body or query; a hit means the server's secrets should be treated as exposed.
3.Rotate deploy tokens, CI/CD variables, database credentials and SSH host keys on any instance that was internet-facing before the patch, and put the instance behind a VPN or identity-aware proxy so the API is not reachable by strangers again.
GlobalUnited StatesUK and EuropeMiddle EastTechnology and softwareFinancial servicesProfessional servicesManufacturingDefense suppliersSource code and IPPasswords and credentialsGitLab CEGitLab EE
The remote-support tool that lets a session copy files to the next machine without asking
ConnectWise released ScreenConnect 26.6.5 to fix CVE-2026-84869, a 9.9-rated missing-authorization flaw in the ScreenConnect client that allows files to be transferred and executed through an active remote session without the host confirming; CISA added it to the KEV catalog on 11 September with a 14 September federal deadline. Huntress traced the exploitation to incidents going back to 20 August in which a caller posing as tech support talked a victim into opening Quick Assist, then a modified ScreenConnect client ran a chain of four VBScript files that surveyed the machine, hid a second ScreenConnect client, set a Run key for persistence and pushed the same four scripts to every newly connected endpoint, which is why Huntress describes the behaviour as worm-like. ConnectWise says the server is not affected and that disabling the TransferFiles permission is the interim mitigation.
The Cyber Expert’s read.ScreenConnect is what a lot of IT providers use to fix your laptop from the other side of town, so a rogue copy of it looks like Tuesday to most monitoring. The story here has two halves: a real bug, and a phone call that got the first foothold, and the patch only closes one of them. Update the clients, then look for ScreenConnect instances your provider did not install, and tell the front desk that nobody from IT will ever ring and ask them to open Quick Assist.
Who this touches:Any business whose IT provider supports it with ScreenConnect, and the providers themselves; the phone-call opener applies to everyone with a Windows fleet.
Strengthen
CIS 7 Continuous Vulnerability Management
CIS 2 Inventory and Control of Software Assets
CIS 14 Security Awareness and Skills Training
CIS 10 Malware Defenses
CIS 6 Access Control Management
Do this week
1.Ask your provider to confirm every ScreenConnect client and server is on 26.6.5 or later; until then have them disable the TransferFiles permission on hosts that do not need it.
2.Inventory ScreenConnect installs across the fleet and remove any that point at a relay your provider does not own; check for a user Run key launching a .vbs file and for wscript.exe spawned by a ScreenConnect client.
3.Restrict Quick Assist and other remote-help tools by policy to sessions your help desk starts, and put one line in the next staff note: IT will never call you and ask you to open a support tool.
GlobalUnited StatesUK and EuropeEvery businessProfessional servicesHealthcareFinancial servicesconstructionPasswords and credentialsPersonal dataConnectWise ScreenConnectWindows Quick Assist
Two medium-rated bugs, one after the other, turned an anonymous request into an Artifactory admin
Wiz Research reported on 10 September that between 15 August and 8 September several actors chained CVE-2026-42018 (7.5, an internal anonymous-user token returned to an unauthenticated caller even with anonymous access off) and CVE-2026-42016 (8.1, a token whose scope is not enforced and can be exchanged for admin authority) against self-hosted JFrog Artifactory, creating persistent admin accounts in under five minutes, installing Groovy plugins for code execution and dropping a Rust backdoor; CISA added both to the KEV catalog on 11 September with a 25 September federal deadline. The chain is separate from the 9.8-rated CVE-2026-82329 we covered on 3 September, and Wiz found 59 percent of Artifactory customers still exposed to CVE-2026-42016 six weeks after its 27 July fix, against 49 percent for the critical one two weeks in. Fixed versions are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
The Cyber Expert’s read.This is the pattern to remember: two bugs nobody rushed because neither was rated critical on its own, and together they are a critical. The tell in the logs is identity mismatch, an anonymous or low-privilege token minting new tokens at /access/api/v1/tokens, enumerating users, or touching the plugins API. Patch the branch, then read the admin list for names like svc_ followed by eight random characters, jfrog-distribution, repo-service or ldap_admin that your team did not create, and revoke every token issued since 15 August.
Who this touches:Software teams and product companies with a self-managed Artifactory, especially one reachable from the internet, and the vendors who build software for you.
Strengthen
CIS 7 Continuous Vulnerability Management
CIS 5 Account Management
CIS 6 Access Control Management
CIS 8 Audit Log Management
CIS 16 Application Software Security
Do this week
1.Upgrade to a fixed Artifactory build this week even if you already patched CVE-2026-82329, because the two chained CVEs have their own fix thresholds (42016 needs 7.133.11 or later on that branch).
2.Review admin users and tokens for anything created since 15 August, delete what you did not make, and revoke and reissue access tokens; in the access log look for POST /access/api/v1/aws/token/ returning 200 followed by a token mint from the anonymous identity.
3.Block the Wiz IOC addresses at the edge, check /tmp, /dev/shm and /var/tmp on the Artifactory host for binaries you did not put there, and move the instance behind your VPN or identity proxy.
GlobalUnited StatesUK and EuropeMiddle EastTechnology and softwareFinancial servicesProfessional servicesManufacturingDefense suppliersSource code and IPPasswords and credentialsJFrog Artifactory
The caller says they are from IT, the page says register your passkey, and the mailbox is gone by lunch
Arctic Wolf published details on 7 September of a data theft and extortion cluster it tracks as PREY-0058 that phones directors, vice presidents and other executives while posing as the internal help desk, sends them to a domain shaped like yourcompany.passkey-mfa[.]com or yourcompany.registermymfa[.]com, and captures the Microsoft 365 password, the MFA approval and the resulting session token through an adversary-in-the-middle login page. The token is then replayed from residential proxies in the victim's own city and network range, the actor searches SharePoint and Entra ID, and bulk-downloads SharePoint, OneDrive, Exchange and Box before sending the extortion note; there is no malware and no lateral movement on the network. Arctic Wolf found hundreds of impersonated companies across the lure subdomains, with US targets concentrated in construction and engineering, healthcare and pharmaceuticals, real estate, finance and professional services, and it notes the tradecraft overlaps with the group Mandiant calls UNC6671.
The Cyber Expert’s read.Nothing here is broken. Every control did what it was told, which is the point: the password was right, the MFA prompt was approved, and the sign-in came from a nearby address. The lure domains all sell the same story, that IT needs you to register a passkey today, so the defence is partly a sentence your staff can repeat: IT will never call and ask you to sign in somewhere. The rest is configuration. Sign-ins from managed devices only, phishing-resistant MFA for anyone who can approve a payment, and a SharePoint search scoped so one stolen session cannot read the whole company.
Who this touches:Any US business on Microsoft 365 with executives who take phone calls, with construction, engineering, healthcare, real estate, finance and professional services named as the current focus.
Strengthen
CIS 6 Access Control Management
CIS 14 Security Awareness and Skills Training
CIS 3 Data Protection
CIS 8 Audit Log Management
CIS 5 Account Management
Do this week
1.Turn on Conditional Access that requires a compliant or hybrid-joined device for Microsoft 365, and move executives, finance and admins to phishing-resistant MFA (passkeys or hardware keys) issued in person, not through a link.
2.Alert on sign-ins to My Signins, My Profile or My Apps from unfamiliar devices, on SharePoint SearchQueryPerformed bursts using contentclass:STS_Site, and on mass download events; block the Arctic Wolf lure domains and any newly registered domain containing passkey, mfa or sso.
3.Brief the help desk and the executive assistants this week: the company will never phone a user to walk them through an MFA change, and any such call is reported, not followed. Apply DLP rules that stop bulk external sharing from SharePoint and OneDrive so a replayed session cannot empty the tenant quietly.
United StatesGlobalconstructionHealthcarereal-estateFinancial servicesProfessional servicesEvery businessSessions and tokensPasswords and credentialsEmail and messagesPersonal dataMicrosoft 365Entra IDSharePointBox
The Cyber Expert is Sam Khan, founder of AccuSights. Relax about the drift. We keep the picture current so you can run the business.
The numbers behind the headline. Regional, and global.
UAE figures come from the Cybersecurity Council. Regional figures come from the Verizon 2026 DBIR. Each one is labeled so you always know which is which.
600K+
attack attempts against the UAE, every day
Daily cyberattack attempts against the UAE surged from a range of 90,000 to 200,000 per day to between 600,000 and 800,000 per day in 2026. The country is a wealthy, digital-first target, and the volume shows it.
UAE Cybersecurity Council, 2026
3 sectors
aviation, energy and education targeted in one coordinated campaign
In August 2026 the Cybersecurity Council confirmed national teams had detected and neutralized a coordinated, multi-vector campaign against vital sectors. The attacks that make the news are the ones that were stopped.
UAE Cybersecurity Council, August 2026
36%
of EMEA breaches carry an espionage motive
Ten times the North American rate. In this region, attackers want your data and your access, not only your money, which changes what needs protecting first.
Verizon 2026 DBIR, EMEA region
42%
of EMEA breaches start with an unpatched flaw
Above the global average of 31%. Combined with credential abuse at 25%, two preventable problems open two-thirds of breaches across the region.
Verizon 2026 DBIR, EMEA region
How breaches happen, globally and here.
Five patterns describe nearly every breach among the 22,000 analyzed worldwide. The regional numbers below them show where we run hotter than the average.
System Intrusion
61%
Social Engineering
17%
Basic Web Application Attacks
10%
Miscellaneous Errors
8%
Privilege Misuse
3%
Europe, Middle East & Africa
Verizon 2026 DBIR regional findings
42%
of breaches start with an unpatched flaw
25%
start with stolen credentials
69%
involve a third party
36%
carry an espionage motive
Espionage motivates 36% of EMEA breaches, ten times the North American rate. Third-party involvement (69%) and the human element (71%) both run above the global baseline.
Sector view
Your sector, your reality.
Regulation in the Emirates runs from federal law to emirate and free-zone frameworks, and the threats vary with the data you hold. Choose your sector.
Every Other Business
Trading companies, retailers, professional firms, family groups. The DBIR counted 7,152 confirmed breaches at small and medium businesses worldwide: every attacker external, every motive financial. UAE businesses sit in one of the most attacked digital environments on earth, with per-emirate data rules that many firms have not yet mapped.
Where to start: A CDPA-aligned assessment tells you what data you hold, which rules apply to it, and what to fix first. Start there.
Current advisories for the region.
Chosen from UAE Cybersecurity Council statements, aeCERT guidance, and the CISA exploited-vulnerabilities catalog. Only what a decision-maker should act on.
CRITICALCISA Known Exploited Vulnerabilities Catalog (added 22 September) and Check Point security advisory
A firewall built for small offices and the console that manages your whole Check Point fleet are both under live attack (Check Point Spark and Management Server, CVE-2026-85102 and CVE-2026-93616)
Who should care: Any business running a Check Point Spark firewall, the line Check Point built for small and branch offices, or a centrally managed Check Point Security Gateway, and any IT provider running one Check Point Management Server across several clients' firewalls, a common setup across the Gulf. Two separate flaws are being used right now. The Spark and Gateway flaw is a certificate-handling hole in the VPN login process: starting 12 September, attackers began logging in through forged certificates that look like ordinary VPN users, no password needed. The Management Server flaw is older and worse, since it hands an attacker root-level access to the console that configures every firewall it manages; targeted attacks against it go back to 23 July, more than seven weeks before Check Point shipped a fix. Both score 9.8 out of 10, and CISA put both on its exploited list on 22 September with a three-day deadline for federal agencies, about as urgent as that list gets.
Do this: Ask whoever manages your Check Point firewall, in-house or through an MSP, whether the fix for CVE-2026-85102 and CVE-2026-93616 is installed, and get a date, not a yes. If you run Spark or a managed Gateway, have them pull VPN and Mobile Access logs for logins using certificates you do not recognize, especially any issuer string containing 'CN=vpn,OU=users', and for internal network scanning right after a login like that. If a Management Server oversees more than one site or client, treat it as compromised until someone checks it directly, since these attacks reach back to July, and do not trust a clean report it generates about itself before that check happens.
CRITICALCISA Known Exploited Vulnerabilities Catalog (added 21 September), Zyxel security advisory, and GreyNoise research reported by BleepingComputer
Nearly a thousand small-office network switches have already been broken into and stripped of data (Zyxel GS1900 series, CVE-2026-7273)
Who should care: Any business, or any IT provider setting up a small office across the Gulf, running a Zyxel GS1900-series switch: the 8, 10, 16, 24 or 48-port models, plain or with power over Ethernet. These are some of the most common budget switches in small-office installs precisely because they are cheap and simple, which usually means nobody logs back in once the setup works. A stack-based buffer overflow in the switch's web management page lets an attacker who can reach that page run commands on the device with no login required. GreyNoise caught the first confirmed attacks on 17 September: a Chinese-speaking group has already broken into roughly 1,000 of these switches across 48 countries and pulled data off them. Zyxel shipped the fix in June, which means every switch still on the old firmware has had three months to be found.
Do this: Have whoever manages your network check every Zyxel GS1900 switch today. Firmware needs to be newer than 2.90(AAHH.1)C0; if it is not, updating it is the only fix, there is no workaround. Then confirm the switch's management page is reachable only from your internal network, never the open internet, because that is almost certainly how the compromised 1,000 were found. If a switch was running old firmware and its page was ever exposed, assume it was touched: reset it, update it, and rebuild the configuration rather than trusting whatever is on it now.
HIGHBrevo incident post-mortem of 17 September and Sansec research, reported by BleepingComputer
The email-marketing widget on your website was hijacked for five hours to push malware at your visitors and plant a backdoor in your WordPress (Brevo)
Who should care: Any organization whose website carries a Brevo signup form, chat widget or tracking script. Brevo, which many owners still know as Sendinblue, is one of the most common newsletter and CRM tools among small and mid-size businesses, in the UAE as much as anywhere, and Sansec estimates up to 100,000 websites load the affected code. On 14 September, for about five and a half hours, someone used a stolen Cloudflare key to rewrite Brevo's scripts at the network edge. Brevo's own servers were never touched, so its integrity checks saw nothing. Visitors to any site loading those scripts got a fake Cloudflare verification page, then instructions to paste a command into Windows, the ClickFix trick, which installs malware on the visitor's computer. If the visitor happened to be a WordPress administrator logged into their own site, the script tried to install a plugin called Web Media Optimizer that hides itself from the plugin list, survives cleanup and carries a hard-coded key that lets the attacker sign in as an administrator without your password. The stolen key had been sitting in Brevo's source code with full account permissions, possibly since late August. It is Brevo's second incident in a week: on 10 September it disclosed a sign-on breach that let attackers hijack customer accounts and phish 347,000 people from one of them.
Do this: If your website uses Brevo, ask whoever manages it to check today whether anyone signed into WordPress as an administrator on 14 September and, if so, to open the plugin list and the must-use plugins folder and remove anything called Web Media Optimizer or anything else that appeared that day. Change every WordPress administrator password regardless. Tell your staff the rule that beats ClickFix every time: no website will ever ask you to open the Run box and paste a command, so if one does, close the tab and call IT. Then ask your web developer one question about every third-party script on your site: if this vendor is compromised, what can their code do on my page? The honest answer is usually anything, which is why the list should be short.
HIGHUAE Cyber Security Council, remarks by Dr Mohamed Al Kuwaiti at the Arab Media Summit in Dubai, reported by The National on 15 September
The UAE's own cyber chief just described a five million dollar ransom demand against a private company, and the region's numbers say it is not an isolated case
Who should care: Every private company in the UAE, not only the banks and ministries that usually make headlines. Dr Mohamed Al Kuwaiti, who heads the UAE Cyber Security Council, told the Arab Media Summit that a hacker broke into a UAE private company, destroyed data tied to its infrastructure, stole more, and called him personally to demand more than five million dollars, then began circulating what was taken on Telegram and the dark web before authorities worked with the company to pull it back. He did not name the company or its size, and that omission says something on its own: this was not a story about a bank or a government entity, it was an ordinary private company. The same week, The National reported ransomware incidents across the wider Middle East climbing from 17 in April 2025 to 357 in June 2026, and UAE hacking attempts running near 800,000 a day since the regional conflict began, roughly four times the pre-conflict baseline.
Do this: Ask whoever runs your IT, in-house or outsourced, two direct questions this week: if we received a ransom demand tomorrow, do we have offline backups we could restore from without paying, and would we know an intruder was inside before they started destroying data. A vague answer to either one is the gap to close first. Report any extortion attempt to the Cyber Security Council rather than negotiating alone. Al Kuwaiti's own advice applies to every business, not just government ones: verify information through official channels, and do not let a compromised account or a convincing phone call decide what you do next.
CRITICALCISA Known Exploited Vulnerabilities Catalog (added 14 September) and Cisco security advisory cisco-sa-esa-inj-2bLVGmhX
A single crafted email can hand an attacker root control of a Cisco Secure Email Gateway, the box that is supposed to be screening your mail (CVE-2026-76461)
Who should care: Any organization that filters incoming mail through a Cisco Secure Email Gateway, physical or virtual, whether you run it yourself or your IT provider runs it for you. Larger firms, hospitals, law practices and anyone with a compliance reason to keep mail filtering on premises are the usual owners. Nobody has to log in and nobody has to click. The attacker sends an email containing database commands, the gateway's own parsing code runs them, and the result is full control of the appliance that sees every message your company receives. Cisco rates it 9.8 out of 10 and published the fix on 14 September. CISA put it on the exploited list the same day, which means someone is already using it. This is the second time in nine months a Cisco email gateway flaw has been used in real attacks; the last campaign left hidden remote-access implants behind.
Do this: Ask whoever runs your mail gateway to upgrade this week to 15.5.5-0141, 16.0.4-3021 or 16.5.0-780, whichever matches your release line. Cisco has published no workaround, so the upgrade is the only fix. Have them confirm the appliance's management interface is not reachable from the internet; Shadowserver counts more than 400 of these boxes exposed right now. If Cisco hosts your filtering through Secure Email Cloud, ask in writing whether your tenant was among the cloud customers Cisco has already contacted about signs of compromise, and to confirm the fix is on. Then ask for a review of the mail logs on every cluster member and the firewall logs around the appliance, because a fix stops the next intruder and does nothing about the one who arrived last week.
CRITICALCISA Known Exploited Vulnerabilities Catalog (added 11 September), ConnectWise security bulletin of 8 September, and Huntress research, reported by SecurityWeek
The remote-support tool your IT provider uses to take over your screen has been spreading malware from one connected computer to the next (ConnectWise ScreenConnect, CVE-2026-84869)
Who should care: Any business whose IT provider connects to its computers with ScreenConnect, and any business that has ever clicked a support link and let a technician in. That covers a large share of companies across the Gulf that outsource IT. Huntress traced attacks back to 20 August: the crooks talked victims into running a doctored ScreenConnect client, then used the live session to push files onto every other computer that client could reach and run them without the technician ever clicking approve. Four scripts went out that way, built to stay put and keep spreading. ConnectWise rated the hole 9.9 out of 10, shipped the fix in version 26.6.5 on 8 September, and CISA gave federal agencies three days to patch once it landed on the exploited list on 11 September. The server side is not affected. The client on your machines is.
Do this: Ask your IT provider today whether every ScreenConnect client on your computers is on 26.6.5 or later, and whether their own technicians' machines are too. Until they can say yes, have them switch off the TransferFiles permission in ScreenConnect, which is the workaround ConnectWise published. Then remind your staff of the one rule that would have stopped this: nobody installs a remote-support tool because a caller or an email told them to. Support sessions start with your IT firm, on your ticket, and nowhere else.
CRITICALCISA Known Exploited Vulnerabilities Catalog (added 10 September), CERT Polska warning of 5 September, and MikroTik September 2026 security bulletin
MikroTik routers, the budget workhorse behind thousands of small offices and building networks, are being taken over without a password (CVE-2026-67277 and CVE-2026-86060)
Who should care: Any organization whose office router, hotspot or branch link is a MikroTik box, which is common wherever an installer chose value over brand. Landlords, cafes, clinics, warehouses and the IT firms that set them up should all check. CERT Polska found six flaws and confirmed that two of them chained together hand a stranger full administrator control of any router whose SSH management port is open to the internet. Attacks have been running since at least 2 September, and the intruders leave behind a hidden administrator account named ops. MikroTik shipped fixes on 3 September and, for the first time, pushed a phone alert to everyone with its app installed. CISA added both flaws to its exploited list on 10 September with a three-day deadline for US agencies.
Do this: Update every MikroTik device to RouterOS 7.24.2, 7.23.4 or 6.49.21 today, then open the user list and delete any account you did not create, starting with one called ops. Close SSH, WebFig and the bandwidth-test service to the open internet so only your own management network can reach them. If the device shows the new Flagged warning after the update, treat it as already compromised: save the logs, reset it to factory settings, rebuild from a configuration you trust, and change every password and key that was stored on it.
CRITICALCISA Known Exploited Vulnerabilities Catalog, Fortinet advisory FG-IR-25-084, Citrix security bulletin, and SOCRadar research on the PivotC2 campaign
Two of the most common firewall and remote-access boxes in Gulf offices are under live attack: Fortinet FortiGate (CVE-2025-25249) and Citrix NetScaler (CVE-2026-19490)
Who should care: Any organization whose internet connection runs through a FortiGate firewall or whose staff log in remotely through a Citrix NetScaler Gateway. Both are standard kit for IT providers across the UAE, so ask if you are not sure. The Fortinet flaw lets a stranger run code on the firewall without logging in, and a Russian-speaking crew has been using it since July to plant a remote-control tool called PivotC2 that tunnels into the network and harvests the firewall's own saved passwords. SOCRadar counts 178 infected devices so far across more than 3,000 targeted addresses. The Citrix flaw lets an outsider walk past the login page of a NetScaler set up as a VPN or authentication gateway. Attack attempts against honeypots started on 3 September, and 36 landed on 8 September alone. CISA added both to its exploited list on 9 September with a three-day patch deadline for US agencies, which tells you how fast it wants this closed.
Do this: Ask your IT provider two questions today: is our FortiGate on a FortiOS build that fixes FG-IR-25-084, and is our NetScaler on 14.1-73.32 or 13.1-63.21 or later. If either box was reachable from the internet before the patch went on, have them change the firewall's admin passwords and any VPN credentials stored on it, and check for outbound connections the device has no reason to make. A patch closes the door. It does not remove anyone already inside.
The threat rundown, daily or weekly
The three minutes that keep you ahead of the bad guy.
Only the threats that apply to your business, with the control that answers each and what to do about it. Written by people who have done this for banks, read by owners who would rather be running the company. UAE and Gulf context included.
About the data
Baseline data: Verizon 2026 Data Breach Investigations Report, the 19th edition of the most comprehensive study of real-world breaches in the industry. More than 31,000 security incidents and 22,000 confirmed breaches across 145 countries, contributed by almost one hundred organizations, from incident response firms to law enforcement to cyber insurers.
AccuSights operates in the UAE with regional advisors and understands the regulatory landscape from federal law to free-zone frameworks. Threat data on this page combines global evidence from the Verizon 2026 Data Breach Investigations Report with public guidance from the UAE Cybersecurity Council and aeCERT.
A breach costs more than money here. It costs licenses, relationships, and a reputation that took a generation to build. Tell us your sector and we will send a complimentary threat and risk report for businesses like yours, then a Cyber Success Engineer will walk you through it, in English or Arabic. No charge, no obligation.
