zero-day

2 posts with the tag “zero-day”

Cisco ISE Zero-Day Is a Perfect 10: Root Access, No Credentials, No Workaround

Sep 22, 2026

Christopher Shaun Godwin

Author

Cisco ISE Zero-Day Is a Perfect 10: Root Access, No Credentials, No Workaround

Cisco shipped an emergency patch for an authentication bypass in Identity Services Engine (ISE) that scores a perfect 10.0 on the CVSS scale and is already under active attack (Cisco advisory, 2026). No workaround exists (Cisco advisory, 2026). Every network that runs ISE for access control should treat this as a break-glass event.

The flaw in one paragraph

The vulnerability is tracked as CVE-2026-76460 with the advisory ID cisco-sa-ISE-ABP-VNSW7Tn5. Cisco published it on September 16, 2026 (Cisco advisory, 2026). The root cause is “insufficient authentication control” on an ISE API endpoint (Dark Reading, 2026).

An unauthenticated, remote attacker sends a crafted request to the affected API endpoint (The Hacker News, 2026). A successful exploit bypasses the web-based management interface and delivers command execution with root privileges (The Register, 2026). No credentials are required (Petri, 2026).

The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means network-based, low complexity, no privileges, and a changed security scope (SOCRadar, 2026). The flaw affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of device configuration (Cisco advisory, 2026; BitSight, 2026).

”Actively exploited” is confirmed, not precautionary

Cisco’s Product Security Incident Response Team stated it is aware of active exploitation and urged customers to install the fix (The Register, 2026). Cisco found the bug while resolving a support case through TAC (Rescana, 2026). That discovery path is the classic signature of a breach already in progress.

CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog on the same day (Rescana, 2026). Federal agencies had until September 19, 2026 to remediate (Rescana, 2026). CISA marks the incident as requiring forensic triage (SecurityWeek, 2026). Known ransomware campaign use is listed as unknown (Rescana, 2026).

The endpoint and the request shape stay unpublished. Cisco withholds those details because the flaw is live (Rescana, 2026). That protects defenders a little and attackers almost nothing, because weaponized exploits now circulate in closed groups (SOC Prime, 2026).

Why ISE compromise is worse than a server compromise

ISE is not a random appliance. ISE sits at the center of network access control (Petri, 2026). It runs identity-based policies, device posture checks, and authentication workflows that decide who gets on the network (BitSight, 2026).

Root on ISE means attackers control the identity and network-control infrastructure (Rescana, 2026). They can grant themselves access, weaken posture checks, and move laterally as trusted devices (SecurityWeek, 2026). One crafted request bypasses the management plane, so exposure control on the device itself is the only stopgap (Cisco advisory, 2026).

This is the third maximum-severity ISE disclosure in two years. CVE-2025-20281 and CVE-2025-20337 both scored 10.0 and both allowed unauthenticated remote code execution (SOC Prime, 2026). Identity platforms keep being the target because they dominate what follows (Rescana, 2026).

What to do this week

Patch ISE and ISE-PIC now. Use the Fixed Software table in the advisory for your release train, including the hardening release published the same day (Cisco advisory, 2026). The emergency releases exist because exploitation is confirmed (SecurityWeek, 2026).
Assume compromise if you cannot prove otherwise. CISA requires forensic triage, not just a patch (Rescana, 2026). Pull logs from the management interface and the API endpoint before the evidence window closes (SOC Prime, 2026).
Restrict the management plane. No workaround exists, so reduce exposure. Put ISE management interfaces behind firewalls and VPN-only access until patched (Cisco advisory, 2026).
Know the blast radius. Posture checks run on this box (BitSight, 2026). After patching, audit device and user posture for unapproved exceptions an attacker may have minted (Petri, 2026).
Watch the API chatter. The vulnerable endpoint is unnamed, but the pattern is not. Look for crafted API requests to ISE that predate the patch and for new SSH or config-change activity afterward (Dark Reading, 2026).

The takeaway

A perfect-10 score, root-level impact, and confirmed exploitation make CVE-2026-76460 the most urgent patch of the week (SecurityWeek, 2026). Treat the September 19 federal deadline as your own. Patch both ISE and ISE-PIC, segment the management plane, and investigate before you declare the incident closed (Cisco advisory, 2026; Rescana, 2026).

One Email, Root Access: Cisco's Mail Gateway Zero-Day Is Under Attack

Sep 16, 2026

Christopher Shaun Godwin

Author

One Email, Root Access: Cisco’s Mail Gateway Zero-Day Is Under Attack

The Cisco Secure Email Gateway exists to keep malicious email out. This week it became a way in. An unauthenticated attacker sends one crafted message and gets root on the appliance (The Register, 2026). Cisco confirmed active exploitation on September 14 (Rapid7, 2026). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026). If you run this appliance, this is the story to act on now.

The flaw: SQL injection in the mail path

The vulnerability is CVE-2026-76461. It is a SQL injection flaw in the email parsing logic of AsyncOS, the software that runs Secure Email Gateway appliances (CyCognito, 2026). The parsing logic does not validate message content before it reaches a database query (CyCognito, 2026). An attacker sends a crafted email carrying SQL statements (BleepingComputer, 2026). The statements execute when the appliance processes the message, and they run commands with root privileges on the underlying operating system (BleepingComputer, 2026).

The advisory carries a CVSS base score of 9.8 out of 10 (Rapid7, 2026). Exploitation needs no credentials and no user interaction (CyCognito, 2026). The attacker does not need access to the management interface (Rapid7, 2026). Sending mail to the gateway is enough.

Why an email gateway is the worst place for this bug

The gateway’s normal job is to process externally delivered email (Rapid7, 2026). That job is the attack surface. There is no “do not expose the admin panel” mitigation, because the vulnerable code path runs on every inbound message. Locking down the device does not reduce exposure.

The bug affects physical and virtual appliances regardless of their configuration (BleepingComputer, 2026). Cisco states there is no workaround (Cisco, 2026). Patching is the only fix (The Register, 2026).

AsyncOS versions 16.5, 16.0, and 15.5 and earlier are affected on physical and virtual appliances (Help Net Security, 2026). The fixed releases are listed below (Cisco, 2026).

Release train	First fixed version
15.5	15.5.5-014
16.0	16.0.4-302
16.5	16.5.0-780

Exploitation: confirmed, ongoing, zero-day

Cisco’s Product Security Incident Response Team became aware of active exploitation in September 2026 (BleepingComputer, 2026). Cisco published the advisory on September 14, 2026 (Rapid7, 2026). CISA added the CVE to its catalog the same day, which points to zero-day exploitation before public disclosure (Rapid7, 2026). The catalog addition orders US federal agencies to remediate the flaw (Security Affairs, 2026).

Cisco found the bug while resolving a Technical Assistance Center support case (The Register, 2026). The vendor has not named the attackers, the attack duration, or the number of compromised organizations (The Register, 2026).

The cloud-delivered product line was hit too. Cisco directly contacted customers who own Secure Email Cloud devices where malicious activity was detected (Help Net Security, 2026).

Cisco shared indicators of compromise. Look for suspicious SQL statements in each cluster device’s mail_logs. Cross-check network and firewall logs for uploads and downloads to external or malicious IP addresses, because attackers may remove evidence of exploitation (BleepingComputer, 2026). Shadowserver currently tracks more than 400 public-facing Secure Email Gateway appliances (BleepingComputer, 2026).

What to do today

Patch outside the normal cycle. Confirm the AsyncOS version on every appliance. Upgrade to 15.5.5-014, 16.0.4-302, or 16.5.0-780 (Cisco, 2026). There is no workaround (Cisco, 2026).
Hunt before you wipe the evidence. Grep mail_logs for SQL fragments embedded in message bodies. Compare firewall and proxy logs for unexpected outbound connections from the appliance (BleepingComputer, 2026). Attackers can remove traces, so collect the logs first.
Treat email infrastructure as a hostile-input product. This is the second AsyncOS root-RCE zero-day in a year. CVE-2025-20393 carried a CVSS score of 10.0 and was exploited by the China-linked group UAT-9686 (SecurityWeek, 2026). Email gateways must process untrusted input by design. Give them the same patch discipline you give routers and identity providers.

The takeaway

A security product that scans hostile mail cannot be secured by hiding it. The AsyncOS mail path processes attacker-controlled content on every message, and this path now hands root to whoever sends the right email. Check the version, patch, and sweep the logs. Attackers are already doing the same math (SOC Prime, 2026).