Skip to main content
Change Risk Intel
Cybersecurity

This Week in Change Risk — Week of Sep 28, 2026

Ben Ennis Founder, Ennis Studio · former Partner Technology Advisor, ServiceNow · 6 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of September 28, 2026. KEV volume was light, but nearly every entry sits on an internet-facing appliance with a three-day clock. The cloud story of the week is a textbook case of two changes that were each fine alone. Here is what mattered for change and risk owners.

KEV additions this week

CISA added three entries to the Known Exploited Vulnerabilities catalog between September 28 and October 1, each due in three days. CVE-2026-104286 is a FortiMail path traversal (CVSS 9.8) that lets an unauthenticated attacker write arbitrary files on versions 7.2.0 through 8.0.1. CVE-2026-76504 in Cisco Catalyst SD-WAN Manager (CVSS 9.8) lets a remote attacker reach the system with admin privileges through flawed API session handling. Apple’s CVE-2026-86950 (CVSS 8.8) is an out-of-bounds write fixed in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

Five entries landed after last week’s recap published. On September 27 came two NetScaler ADC and Gateway zero-days. The Citrix bulletin CTX697096 says CVE-2026-88771 works against default configurations. On September 25 came SharePoint code injection (CVE-2026-65660), a MikroTik RouterOS SSH flaw and a WordPress core file-inclusion bug. Our live KEV tracker carries all eight with due dates.

Cloud incidents worth noting

Azure had the incident every CAB should read this week. Per Azure status history (tracking ID 7Q30-010), from 20:30 UTC on September 30 to 02:15 UTC on October 1, customers in multiple regions lost or saw degraded connectivity through ExpressRoute Gateway, VPN Gateway, Azure Firewall, Application Gateway and Azure VMware Solution. Microsoft’s preliminary cause names two changes. A recent change to a regional gateway management service raised load. Then an unrelated operating-system servicing rollout moved through regions, and the dependent services could not scale. Engineers spotted the correlation at 23:05 UTC and paused the servicing. They recovered by reverting the gateway-manager change. The weakness to note is that each change was presumably safe on its own, and nothing flagged the overlap. Microsoft says its review of scaling safeguards is still open. If your change calendar only tracks your own work, this is the argument for adding provider maintenance to it. The cloud status heatmap is a quick way to see that context.

Vendor moves

ServiceNow launched Flow on October 1, a standalone conversational service desk that works in Slack, Teams and email. Per the ServiceNow announcement, it needs no implementation project, and users can turn a resolved request into an automated workflow with one click. It is in controlled availability now, with general availability in North America and EMEA expected in Q4 2026. The weakness for risk owners is that same one-click step. A workflow created from a chat thread is a production change, and it should land in your change record, not bypass it.

Snyk published a frank correction. Its product update says removing the “fix example” factor on September 1 cut some Snyk Code priority scores by up to 200 of 1,000 points and reordered findings. The August release notes had said no action was required. Snyk calls that wrong, apologized, and now requires score changes to appear in release notes. If your remediation SLAs key off priority score, your queue changed without notice.

Compliance and regulatory

On September 28, the PCI Security Standards Council released version 2.0 of the Secure Software Lifecycle Standard, the first major revision of the standard. Secure SLC is one of two standards in PCI’s Software Security Framework and covers how software vendors run secure development. Version 2.0 aligns with the Secure Software Standard v2.0 released in January, including its focus on “sensitive assets” and a new Sensitive Asset Identification Document. It also adds requirements on “digital tools,” which explicitly include AI used inside a vendor’s development lifecycle. The Council says it narrowed the standard to the vendor’s lifecycle alone and wrote its requirements to flex across maturity levels. A summary of changes, program guide and validation templates are in the PCI document library, and assessor training is planned for Q4 2026. For buyers of payment software, the practical step is to ask your vendors whether their AI coding tools now appear in their validated lifecycle evidence. This is a summary of a published standard, not compliance advice for your environment.

Change-management community

The most-discussed operations thread on Hacker News this week (171 points, 149 comments) was a Claude outage on September 29. The Claude status page records elevated errors from 14:00 to 14:59 UTC across claude.ai, the API, Claude Code and Cowork. A second problem blocked sign-in, including single sign-on, and some messages sent in that hour may not have been saved. The incident page does not state a root cause, which is its weakness as an input to your own review. One mitigation note stood out: signed-in users were told not to sign out. The change-management point is not about one AI vendor. Many teams now run coding agents and AI assistants inside their release work. If a change runbook depends on a hosted model, the change window depends on that provider’s identity layer, too. Add AI services to the same upstream-dependency list you keep for cloud and SaaS providers.

Chart of the week

Bar chart of CISA KEV additions per ISO week from week 33 to week 40 of 2026: 3, 9, 11, 10, 14, 7, 12 and a partial 3, against a week 33 to 39 average of 9.4

This chart counts KEV additions per ISO week from the dateAdded field in CISA’s catalog JSON, version 2026.10.01. Week 40 shows three entries through Thursday, well under the seven-week average of 9.4, though Friday additions may still land. A correction on our own data: last week’s recap counted seven entries for week 39 because it went out Friday morning. Five more arrived on September 25 and 27, including both NetScaler zero-days, so week 39 settled at 12, the second-highest week in the window. That pattern now has a name in our planning: weekend and Friday additions keep showing up after the weekly CAB has met. If your emergency-change process assumes a Monday review, a Saturday KEV entry with a Tuesday due date gives you one business day. Our BOD 26-04 decision matrix covers who can approve inside that window.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents, and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management

Published October 2, 2026.