The Lumora Security Brief: UAE Cybersecurity Threats in September 2026

A private-sector company faced a cyber extortion demand exceeding $5 million, while attackers actively exploited vulnerabilities in widely used firewall and remote-access platforms.

Security advisories from Check Point, Cisco and Citrix also raised concerns about vulnerabilities affecting systems that organisations depend on to protect their networks.

This month's Lumora Security Brief covers the incidents reported in September, their technical implications, and the security controls IT teams should review.

September's cybersecurity threat updates

UAE private-sector organisation targeted in cyber extortion case involving over $5 million

Reported: September 15, 2026 | Risk: Critical

A private-sector organisation supporting a UAE government sector was reportedly breached, with attackers gaining access to internal systems and data.

According to the UAE cyber security chief, the attacker demanded more than $5 million and threatened to publicly disclose stolen information. The incident also involved reported data destruction and attempted data leakage. The identity of the affected organisation and the initial method of compromise were not disclosed.

Source: The National, September 15, 2026

Check Point firewall and security management vulnerabilities actively exploited

Reported: September 22, 2026 | Risk: Critical

Check Point reported active exploitation of vulnerabilities affecting its Security Gateway and Security Management products.

The advisory identifies two vulnerabilities:

• CVE-2026-85102: A vulnerability affecting Check Point security infrastructure that was under active exploitation.

• CVE-2026-93616: A newly identified pre-authentication vulnerability affecting security management products.

The concern is the potential compromise of infrastructure responsible for enforcing and managing an organisation's network security policies.

Source: Check Point Security Advisory

WordPress plugin supply-chain attack compromises approximately 1,500 websites

Reported: September 15, 2026 | Risk: High

A compromise involving the developer infrastructure of the Admin Menu Editor Pro WordPress plugin resulted in malicious software updates being distributed to customers.

The affected updates contained a web shell and a hidden account, potentially allowing attackers to maintain unauthorised access to compromised websites. At least 1,500 WordPress installations were reportedly affected.

Source: Admin Menu Editor Pro Security Incident Notice

Additional technical security alerts

September also saw exploitation and security disclosures affecting other enterprise technologies.

Cisco Secure Firewall Management Center, CVE-2026-20079

Cisco confirmed active exploitation of an authentication-bypass vulnerability in vulnerable Secure Firewall Management Center systems. The flaw could allow unauthenticated remote attackers to execute commands with root privileges. Affected organisations should apply vendor fixes and review administrative access.

Cisco Identity Services Engine, CVE-2026-76460

A critical vulnerability affecting Cisco ISE and ISE-PIC could allow unauthenticated attackers to bypass authentication. Cisco confirmed active exploitation. Organisations using affected versions should review the vendor advisory and remediate vulnerable deployments.

PaperCut NG/MF vulnerabilities

PaperCut reported active exploitation of critical vulnerabilities affecting its enterprise print-management software, with customer incidents confirmed. Security maintenance releases were made available, and affected customers were advised to update their installations.

Counterfeit software installers

Microsoft identified an active malware campaign using counterfeit software-download websites and malicious installers. Users downloading applications from these sites risk executing malicious software on their endpoints.

IT teams should restrict software installations to approved sources, review endpoint protection policies and monitor suspicious installer execution.

Technical focus: Data theft and extortion

$5M extortion case for not releasing data is an operational concern in UAE. Even with enterprise level security, a privately-held organization couldn’t be safe. This raises an important question: would your existing monitoring detect someone collecting and transferring sensitive company data?

What are the first signs of data exfiltration?

Consider a hypothetical scenario where an attacker has gained access to a legitimate employee account. The account suddenly accesses hundreds of files from a sensitive repository. Shortly afterwards, a large archive is created on an endpoint, followed by an unusual volume of outbound traffic.

MITRE ATT&CK techniques T1005 (Data from Local System) and T1567 (Exfiltration Over Web Service) are as relevant to data theft. Security teams should look for unusual file access patterns, suspicious archive creation and unexpected outbound transfers involving sensitive systems.

Which security logs help investigate suspected data theft?

An analyst investigating potential data exfiltration needs to reconstruct activity across multiple systems.

Identity logs can reveal unusual sign-ins, unexpected privileged sessions or changes to authentication methods.

File and application logs can help establish which accounts accessed sensitive information and whether unusual downloads occurred.

Endpoint logs can show suspicious processes, archive creation and unusual PowerShell activity associated with the device.

Firewall and cloud logs can provide information about outbound connections, transfer volumes and destinations.

Correlating these records through SIEM or SOC monitoring can help investigators determine whether suspicious activities are connected.

Can firewall logs confirm whether data was stolen?

Not always. Firewall logs may reveal large outbound transfers without identifying the files involved, especially when traffic is encrypted. Investigators need to correlate network activity with endpoint and file-access records to distinguish legitimate transfers from possible data theft.

As an IT or security team, the investigation should establish which accounts and systems were involved, what information may have been accessed and whether suspicious activity is ongoing. Where sensitive information may have been exposed, the response must also consider applicable reporting and notification requirements.

Cybersecurity events in the UAE: September–November 2026

Past event

GISEC Global 2026 | 16–18 September | Dubai, UAE

Held at Dubai Exhibition Centre, one of the flagship events GISEC Global brought together cybersecurity experts, government representatives and technology providers. Discussions covered emerging cyber threats, AI security, quantum computing and critical infrastructure protection.

Here’s the glimpse of Lumora Team at GISEC

Upcoming events

Red Hat Summit: Connect 2026 | 20 October | Dubai, UAE

A technology conference covering hybrid cloud security, DevSecOps, secure software supply chains and enterprise IT infrastructure. The programme includes technical sessions and hands-on labs.

Explore the event

CYSEC UAE 2026 | 22 October | Abu Dhabi, UAE

A cybersecurity summit bringing together security leaders and industry experts to discuss Zero Trust architecture, cloud security, AI-driven cyber defence and critical infrastructure protection.

Explore CYSEC UAE

Essential security is the essential start you need.

Every organisation has different risks, but understanding which essential security controls are working and where the gaps exist is a useful place to start.

Explore Lumora's Essential Security Review to see how we assess existing security controls and identify areas requiring attention.

‍