Skip to main content
Change Risk Intel
Cybersecurity

This Week in Change Risk — Week of Sep 21, 2026

Ben Ennis Founder, Ennis Studio · former Partner Technology Advisor, ServiceNow · 6 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of September 21, 2026. KEV volume landed right at last week’s level, but the mix was harsher: nearly every entry sits on an edge or access device, and every one arrived with a three-day remediation window. Here is what mattered for change and risk owners.

KEV additions this week

CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalog between September 21 and 24. The headline is CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM that allows unauthenticated remote code execution when an access policy and an OAuth profile are configured on a virtual server. CERT-EU notes F5 confirmed exploitation in the wild and offers an iRule mitigation through F5 Support for teams that cannot patch inside the window. The same day brought two Check Point bugs, CVE-2026-93616 (path traversal and file upload, CVSS 9.8) and CVE-2026-85102 (improper certificate validation during VPN negotiation, CVSS 9.8), plus CVE-2026-93952 in on-prem Arista VeloCloud Orchestrator (CVSS 9.5). Zyxel GS1900 switches (CVE-2026-7273, CVSS 8.8), WSO2 API products (CVE-2026-5430), and Adobe Commerce and Magento (CVE-2026-71362, CVSS 9.1) round out the list. That is four remote-access or network-edge products in one day, each on a three-day clock, which is the pattern our BOD 26-04 decision matrix was built for.

Cloud incidents worth noting

Cloudflare carried a long-running incident all week. Per the Cloudflare status page, “since September 21, 2026 at 02:20 UTC, multiple subsea cable outages have caused congestion between Tokyo and Singapore datacenters.” Cloudflare rerouted traffic and worked with third-party vendors to restore capacity, marked a fix as implemented on September 25, and kept the incident in monitoring. The same incident history logged smaller problems in the window: Cloudflare One clients incorrectly challenged on some sites, intermittent authentication errors for the API and R2, and BYOIP customers unable to update BGP prefixes. None of these started with a change on the customer’s side, and that is the point. A provider’s physical-layer failure can quietly raise latency on your change window for days. If your go/no-go checklist only looks at your own monitoring, add the upstream status pages you depend on; our cloud status heatmap puts them in one view.

Vendor moves

PagerDuty took SRE Agent Skills to general availability on September 21 and made Scoped OAuth for Public Apps generally available on September 22, per the PagerDuty changelog. Scoped OAuth is the more useful change for risk owners, because narrower tokens shrink what an integration can do if it is compromised. Vanta, per its What’s New page, put custom agents that run recurring GRC workflows on a schedule into public preview on September 22, with approval required before “sensitive actions” execute. The weakness is shared: both vendors are putting agents closer to production systems and audit evidence. PagerDuty’s agent skills need the same change records and rollback expectations as a human responder, and Vanta’s approval gate is only as good as your definition of “sensitive.” If an agent can change the evidence your auditor samples, that workflow belongs in change control too.

Compliance and regulatory

The EU Cyber Resilience Act’s reporting obligations are now two weeks old. Since September 11, 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA’s Single Reporting Platform, per the European Commission. The CRA summary sets the clock: an early warning within 24 hours, the main notification within 72 hours, and a final report no later than 14 days after a fix or mitigation is available. This week’s KEV list shows why that matters for vendors like F5 and Check Point, and indirectly for their customers. When a supplier’s disclosure clock and CISA’s three-day remediation clock both start from the same exploitation, your change board may get the patch, the mitigation, and the regulatory notice within a single business day. Build the intake path for vendor advisories now, not when the next one lands.

Change-management community

The most-discussed change failure this week was a refrigerator. Owners of Samsung smart fridges reported units that stopped cooling and went dark after a SmartThings software update, and Samsung said the update “was incorrectly distributed to some customers during testing,” per The Chosun Daily. Samsung halted distribution, formed an emergency response team, and said it planned to find affected customers from update history, with free repairs and food-spoilage compensation under review. The Hacker News thread drew more than 270 comments, most asking the same question: how did a test build reach real customers with no canary ring and no remote rollback? The lesson carries straight into IT. A change that cannot be rolled back remotely is not a normal change, whatever the vendor calls it. Separate test and production distribution channels, and size the first rollout stage so the first failure stays small.

Chart of the week

We counted CISA KEV additions per ISO week directly from the catalog JSON for the last eight weeks, then scored this week’s entries against NVD severity.

Bar chart of CISA KEV additions per week from week 32 to week 39 of 2026, with week 39 at 7 against an 8-week average of 8.4, and a side panel showing six critical and one high severity entry this week

This week’s seven additions sit just under the eight-week average of 8.4. The count hides the story. All seven carry a three-day due date, and six score CVSS 9.0 or higher. A correction on our own data: last week’s recap counted four entries for week 38 because it published Friday morning. Three Linux kernel entries landed later on September 18, so week 38 settled at seven. The lesson for planning is the same one the chart has shown for two months. Severity and deadline matter more than volume, and a quiet-looking week can still fill your emergency-change track.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents, and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management

Published September 25, 2026.