Your Router is Having a Mid-Life Crisis

# Your Router is Having a Mid-Life Crisis It's Sunday night. If you're reading this, you probably spent your weekend figuring out why the secure setup your vendor promised is actually an open door. The CISA KEV list grew a lot this week. We need to be honest about what needs a reboot right now and what can wait until Monday morning. Deal with the N-able N-central flaws first (CVE-2026-86218), and this is a pre-auth RCE. That means someone can run code on your system without needing a password. If you run an MSP, this is a red alert. The ripple effect is brutal because when an MSP tool gets hit, it isn't just one company going down. It's every single downstream client they manage; you aren't just patching a server here; you're closing a backdoor to fifty other businesses. Check your MikroTik gear next. Two vulnerabilities (CVE-2026-86060 and CVE-2026-67277) hit the KEV on September 10. Routers sitting on your perimeter are basically beacons for anyone with a basic scanner. Then there is the GitLab path traversal (CVE-2026-85706); how does this actually work? A path traversal happens when an application takes user input, like a filename, but doesn't sanitize it. This lets an attacker use `../` sequences to climb out of the intended directory and grab sensitive files like `/etc/passwd`. Some people think the fix is a clever regular expression to block dots. It isn't. Claude Shannon would tell you that you can't rely on a fragile filter when the system is too permissive. The only real fix is using a restricted filesystem handle or a chroot jail so the process physically cannot see anything outside its own sandbox, and anything else is just security theater. The ConnectWise ScreenConnect bug (CVE-2026-84869) also needs your attention by tomorrow, September 14. It's another authorization failure. You can probably relax about the other stuff, and the JFrog Artifactory bugs are bad, but unless you've left your binary repository open to the public internet, which is a mistake, you have time to test the patch first. Then there's Chrome V8 and CVE-2026-87491. The BlueMoon exploit kit is hunting for it. Since Chromium updates are usually automatic and kick in when you restart, you're probably fine unless you're stuck on an ancient build. Microsoft patched 974 flaws this month, and that's just a normal Tuesday in 2026. Unless you see signs of the two zero-days actually hitting your endpoints, don't let a long list of patches scare you into breaking your production environment over a weekend. I think more pre-auth surprises are coming this quarter, and software architects have this delusion that complexity means security. They keep adding layers of abstraction and calling it military grade; I hate that phrase because real military gear is built to be simple and durable, not some bloated API wrapper. Most crypto flaws aren't about math failing, and they're failures in key management or a developer just forgetting to check if a user was logged in before letting them run a system command. Who is actually at risk? Look at the Mathspace breach with over 1 million records, and it shows that while we worry about RCEs, hackers still get into networks by stealing emails and passwords from a third party who didn't salt their hashes. The cost to fix this varies, and if you have a staging environment and an automated pipeline, it'll take about four hours of engineering time for testing and deployment. If you're doing this manually on a fleet of Cisco boxes and MikroTiks, expect to lose your whole Monday.