Reported by 38 outlets
A newly KEV-listed Cisco ISE bug lets an unauthenticated attacker get root - no login needed. 9 detections, 9 IOCs. Full analysis + IOCs: ht
Why this score
- Breadth
- 2.00 / 2.0 · 38 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Cisco disclosed CVE-2026-76460 on September 16, 2026 in advisory cisco-sa-ISE-ABP-VNSW7Tn5: an API endpoint in Identity Services Engine and ISE Passive Identity Connector applies authentication controls so weakly that a single crafted request bypasses the web-based management interface, rated CVSS 10.0 and exploitable regardless of device configuration. Cisco PSIRT confirmed the flaw was exploited in the wild as a zero-day, CISA added it to the KEV catalog the same day with a September 19 remediation deadline for federal civilian agencies, and successful exploitation can end in commands run as root. Cisco found the bug through a technical support case, named no attacker, and reported the endpoint also supports arbitrary file upload and download. The same release batch carried 20 ISE CVEs, 12 of them critical, including the previously public CVE-2026-20282, CVE-2026-20283 and CVE-2026-20284, an improper access control bypass tracked as CVE-2026-20192, and critical hardening items CVE-2026-20234, CVE-2026-20331 and CVE-2026-20332.
Root on ISE is not one more server takeover: the appliance decides which users and devices get onto the network. An attacker holding it can rewrite access policy to admit their own hardware, extract the credentials ISE stores, erase or conceal the very logs Cisco points defenders at, and then move through every segment ISE polices, as VulnCheck exploit developer Landon Rice put it. No exposed-asset count exists for ISE this cycle, and that is structural rather than an oversight, because most ISE management planes sit inside the data center where external scanners never see them; the population at risk is every appliance reachable from any compromised interior host, which no Shodan query will enumerate. What makes this story the one to work from the week's pile is repetition. June 2025 brought CVE-2025-20281, CVE-2025-20282 and CVE-2025-20337, all CVSS 10.0 in the same API surface, with attempted exploitation confirmed within a month and fixes in 3.3 Patch 7 and 3.4 Patch 2. Fifteen months later Cisco ships 41 ISE fixes at once while Check Point, its closest architectural rival in the policy and gateway plane, took two pre-auth root flaws and confirmed exploitation of CVE-2026-85102 starting September 12. Identity policy engines are a standing target category now, and treating each advisory as an isolated event is how fleets of unpatched policy servers accumulate.
Upgrade ISE and ISE-PIC to 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11 or 3.1 Patch 12. No workaround exists, so until every node is patched, restrict traffic to the appliance with infrastructure ACLs and hold management access to admin jump hosts only. Cisco's hunt is specific: review access.log for suspicious usernames, and in distributed deployments collect it from every node. Treat those logs as perishable, since root access permits their deletion, so ship them off-box first and reconcile recent administrative sessions against configuration change history before trusting the appliance's own view of what happened. Organizations also running the Check Point products in this cluster should confirm LivePatch Take 26 or Jumbo Hotfix Accumulator Takes 44 (R82.10), 126 (R82), 166 (R81.20) and 190 (R81.10) for CVE-2026-85102 and CVE-2026-85103, search Logs and Events for certificate-based Mobile Access logins with subjects CN=vpn, CN=vpn-user or CN=vpnuser, and check the CVE-2026-91843 marker "Administrator failed to log in: Username too long" in Audit and Admin login logs.
Two developments would change this assessment. A public proof of concept for CVE-2026-76460 would move exploitation from whoever triggered Cisco's support case to every commodity scanning crew within days, the pattern the 2025 ISE bugs followed once ZDI disclosures circulated. Confirmation that victims extend beyond the initial support case, or an attribution, would turn a patch sprint into an incident-response exercise, because root on the policy engine means intruders had the keys to delete their trail and to let themselves back in through policy they wrote.
Timeline
-
update from sec.cloudapps.cisco.com
Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
sec.cloudapps.cisco.com · 476d ago · June 25th, 2025
Cisco's June 25, 2025 advisory covers CVE-2025-20281 and CVE-2025-20282 in ISE and ISE-PIC, both rated CVSS 10.0. CVE-2025-20281 stems from insufficient validation of user-supplied input in a specific API and allows OS-level command execution; CVE-2025-20282 lets crafted files be uploaded into privileged directories through another API. Both were fixed in ISE 3.3 Patch 7 and 3.4 Patch 2 and were reported through Trend Micro's Zero Day Initiative.
-
update from bleepingcomputer.com
Max severity Cisco ISE bug allows pre-auth command execution - patch now
bleepingcomputer.com · 454d ago · July 17th, 2025
BleepingComputer covered CVE-2025-20337 on July 17, 2025 as a maximum-severity Cisco ISE flaw allowing unauthenticated, pre-authentication command execution. The bug joined the same June 2025 advisory and was fixed in ISE 3.3 Patch 7 and 3.4 Patch 2, marking the previous exploitation cycle for the same product line.
-
update from securityweek.com
Hackers Start Exploiting Critical Cisco ISE Vulnerabilities
securityweek.com · 447d ago · July 23rd, 2025
SecurityWeek reported on July 23, 2025 that Cisco updated the June advisory to confirm attempted in-the-wild exploitation of CVE-2025-20281, CVE-2025-20282 and the newly added CVE-2025-20337, all CVSS 10.0 and all yielding root command execution via crafted API requests.
-
update from support.checkpoint.com
sk1000117 - CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
support.checkpoint.com · 37d ago · September 7th, 2026
Check Point's advisory for CVE-2026-85102, created September 7, 2026, describes improper validation of certificate data during VPN negotiation that lets an unauthenticated remote attacker execute arbitrary code on a Security Gateway, CVSS 9.8. Affected releases span R81.20, R82 and R82.10 plus end-of-support R80 through R81.10; R82.20 is not affected. The page was later updated to state the vulnerability is actively exploited on Spark Firewalls as of September 12, 2026, and to add a hunt for certificate-based Mobile Access logins using subjects such as CN=vpn, CN=vpn-user and CN=vpnuser with O=global, with fixes in LivePatch Take 26 and Jumbo Hotfix Accumulator Takes 44 (R82.10), 126 (R82), 166 (R81.20) and 190 (R81.10).
-
update from support.checkpoint.com
sk1000118 - CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution
support.checkpoint.com · 37d ago · September 7th, 2026
Check Point's companion advisory for CVE-2026-85103, dated September 7, 2026, describes a heap overflow in the VPN certificate ASN.1 decoding flow that may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway.
-
update from radar.offseq.com
CRITICAL CVE-2026-85103 in Check Point Quantum Security Gateway: Heap-based buffer overflow in VPN certificate ASN.1 decoding allows unauthe
radar.offseq.com · 34d ago · September 9th, 2026
CRITICAL CVE-2026-85103 in Check Point Quantum Security Gateway: Heap-based buffer overflow in VPN certificate ASN.1 decoding allows unauthe
via Mastodon https://radar.offseq.com/threat/cve-2026-85103-cwe-122-heap-based-buffer-overflow-in-checkpoint-quantum-security-gateway-769c0bcac8d0fa47
-
update from securityonline.info
Check Point fixed critical Check Point VPN vulnerabilities. Update gateways to prevent remote code execution under CVE-2026-85102 and CVE-20
securityonline.info · 34d ago · September 9th, 2026
Update gateways to prevent remote code execution under CVE-2026-85102 and CVE-20
via Mastodon https://securityonline.info/checkpoint-vpn-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social
-
update from malware.news
Check Point security advisory (AV26-902)
malware.news · 34d ago · September 9th, 2026
Serial Number: AV26-902 Date: September 9, 2026 As of September 9, 2026, Check Point is affected by vulnerabilities in the following products: Security Gateway Multiple versions Check Point Spark Firewall using Site to Site VPN or Remote Access VPN Multiple versions Security Management Server Multiple versions Check Point Spark Firewall Multiple versions The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
mentioned by cyberworldops.eu
Check Point patched two critical VPN certificate handling flaws, CVE-2026-85102 and CVE-2026-85103, both rated 9.8. They allow unauthenticat
cyberworldops.eu · 33d ago · September 10th, 2026
-
update from cyberpress.org
Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code
cyberpress.org · 33d ago · September 11th, 2026
Check Point has disclosed two critical vulnerabilities in its VPN technology that could allow unauthenticated remote attackers to achieve remote code execution (RCE) under specific conditions. The company said its internal research team discovered and remediated both issues and that it currently has no indication they are being exploited in the wild. The vulnerabilities present a significant risk because internet-facing VPN gateways are commonly used to provide remote connectivity into enterprise networks. Critical Check Point VPN Flaws Successful exploitation could give an attacker a foothold at the network perimeter without requiring valid credentials, potentially enabling further lateral movement, credential theft, data exfiltration, or ransomware deployment . An authentication bypass weakness can allow an attacker to circumvent controls intended to verify a user or system before granting access to protected services. When paired with an RCE condition, the impact can be severe: an unauthenticated attacker may be able to execute code on the vulnerable security gateway without first obtaining a VPN username, password, certificate, or multifactor authentication approval.
-
update from gbhackers.com
Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code
gbhackers.com · 32d ago · September 11th, 2026
Check Point said its internal research team discovered and resolved these […] The post Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by beyondmachines.net
Check Point Patches Critical VPN Certificate Flaws Enabling Unauthenticated RCE Check Point patched two critical 9.8-rated vulnerabilities i
beyondmachines.net · 32d ago · September 11th, 2026
-
update from securityweek.com
Check Point Patches Critical VPN Vulnerabilities
securityweek.com · 32d ago · September 11th, 2026
As a mitigation, Check Point recommends manually defining VPN rules. “For Site to Site VPN, disable implied rules for VPN and manually define VPN access for UDP/500 and UDP/4500 for the specific peer IP addresses,” Check Point recommends. The company also notes that the mitigation does not apply to locally managed Spark Firewall instances. Users with locally managed instances are advised to apply the latest Jumbo hotfixes as soon as possible. Customers with Check Point LivePatch enabled will receive the patches automatically.
-
mentioned by www.redhotcyber.com
Two vulnerabilities in Check Point VPN allow RCE without password. Link to article: https://www.redhotcyber.com/post/due-vulnerabilita-in-check-point-vpn-consentono-rce-senza-password/
www.redhotcyber.com · 31d ago · September 12th, 2026
-
update from bleepingcomputer.com
Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
bleepingcomputer.com · 31d ago · September 12th, 2026
The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. Although no public proof-of-concept (PoC) exploit has been reported, the agency is urging organizations to install the security updates addressing the two issues as soon as possible. “The NCSC assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon,” the NCSC warns . Check Point VPN is an enterprise solution that allows remote employees to securely connect to their company's internal network via encrypted connections. On September 9, Check Point issued fixes for the flaws along with separate security advisories describing them: sk1000117 and sk1000118 .
-
mentioned by www.bleepingcomputer.com
Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent https:// bleepingcomputer.com/news/security/ dutch-ncsc-critical-check-p
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 Dutch NCSC warns of imminent exploitation of two critical Check Point VPN flaws. CVE-2026-85102: cert validation issue, RCE on Security Ga
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by www.bleepingcomputer.com
Dutch NCSC warns: critical vulnerabilities in Check Point VPNs are about to be actively exploited. VPNs remain
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by dev.to
Check Point VPN CVE-2026-85102 and CVE-2026-85103: Early Warning for Pre-Authentication RCE # security # threatintel # software # coding # d
dev.to · 31d ago · September 13th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 Dutch NCSC warns exploitation is imminent for two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103. Patch internet-expose
www.bleepingcomputer.com · 31d ago · September 13th, 2026
-
update from cyberwald.com
Cyberwald Cybersecurity News - 13.09.2026 Today's Podcast: Check Point VPN NCSC warns of critical vulnerabilities CVE-2026-85102 and CVE-
cyberwald.com · 30d ago · September 13th, 2026
🎙️ Cyberwald - Cybersecurity-News - 13.09.2026 Heute im Podcast: • Check Point VPN: NCSC warnt vor kritischen Lücken CVE-2026-85102 und CVE-
via Mastodon https://cyberwald.com/podcast/2026-09-13.podcast.ogg
-
mentioned by thecybersecguru.com
🚨 Check Point has patched two critical vulnerabilities in its VPN infrastructure, and both carry a CVSS score of 9.8. CVE-2026-85102 and CVE
thecybersecguru.com · 30d ago · September 13th, 2026
-
mentioned by cyber.netsecops.io
📰 Check Point patches two critical 9.8 CVSS flaws in VPN products Check Point patches two critical 9.8 CVSS vulnerabilities (CVE-2026-85102,
cyber.netsecops.io · 30d ago · September 13th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Two critical remote code execution vulnerabilities in Check
threatnoir.com · 30d ago · September 14th, 2026
-
update from cyberpress.org
Critical Check Point VPN Flaws Could Face Large-Scale Exploitation, NCSC Warns
cyberpress.org · 29d ago · September 14th, 2026
The Netherlands’ National Cyber Security Center (NCSC) has warned organizations to urgently patch two critical vulnerabilities in Check Point VPN products , saying widespread exploitation attempts are likely to begin soon. Check Point VPN products are widely deployed to establish encrypted connections between users, branch offices, and corporate networks across the internet. Critical Check Point VPN Flaws Because VPN gateways are often internet-facing and provide access to internal resources, critical flaws in these systems can create an attractive initial-access route for threat actors. The second vulnerability, CVE-2026-85103, involves certificate-processing functionality. The combination of internet exposure, unauthenticated exploitation, and remote code execution makes the vulnerabilities particularly dangerous. An attacker who gains code-exec
-
mentioned by diesec.com
Dutch NCSC: exploitation of new Check Point VPN flaws (CVE-2026-85102/85103, CVSS 9.8) is imminent, before Check Point saw any attacks. Pre-
diesec.com · 27d ago · September 16th, 2026
-
mentioned by securityonline.info
Check Point fixed a critical Check Point login flaw (CVE-2026-91843). Patch this Check Point login flaw now to block unauthenticated remote
securityonline.info · 27d ago · September 16th, 2026
-
mentioned by securityonline.info
An exploited Cisco ISE vulnerability (CVE-2026-76460) allows remote root access. Patch this critical Cisco ISE vulnerability to secure netwo
securityonline.info · 27d ago · September 16th, 2026
-
update from support.checkpoint.com
🚨 Please read this important update from Check Point: CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Se
support.checkpoint.com · 27d ago · September 16th, 2026
🚨 Please read this important update from Check Point: CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Se
via Mastodon https://support.checkpoint.com/results/sk/sk1000155
-
update from sec.cloudapps.cisco.com
CVSS 10 vuln in Cisco ISE. Are we freaking out about this? I feel ready to freak out about it... :ablobcatnod: https:// sec.cloudapps.cisco.
sec.cloudapps.cisco.com · 27d ago · September 16th, 2026
CVSS 10 vuln in Cisco ISE. Are we freaking out about this? I feel ready to freak out about it... :ablobcatnod: https:// sec.cloudapps.cisco.
-
mentioned by censys.com
🚨New Censys Advisory: CVE-2026-91843 A critical (CVSS 9.8) unauthenticated RCE affects Check Point Quantum Security Management and Log Serve
censys.com · 27d ago · September 16th, 2026
-
mentioned by securityonline.info
Cisco patched critical Cisco ISE vulnerabilities. Install updates to fix Cisco ISE vulnerabilities and prevent remote code execution and roo
securityonline.info · 27d ago · September 17th, 2026
-
mentioned by sec.cloudapps.cisco.com
CVE-2026-20234, CVE-2026-20332 and CVE-2026-20331 are critical vulnerabilities Cisco disclosed on September 16 in internal hardening release
sec.cloudapps.cisco.com · 27d ago · September 17th, 2026
-
mentioned by gbhackers.com
Critical Check Point Vulnerability Allows Remote Root Code Execution Without Authentication
gbhackers.com · 26d ago · September 17th, 2026
-
update from cyberpress.org
Critical Check Point Flaw Lets Remote Attackers Gain Root Code Execution Without Login
cyberpress.org · 26d ago · September 17th, 2026
The vulnerability carries a CVSS score of 9.8 and affects the login process on Check Point management infrastructure . According to the vendor, a specially crafted authentication request can trigger a stack overflow before a user successfully logs in, potentially enabling an attacker to run code remotely with the highest system-level privileges. A successful compromise could therefore give attackers a foothold in a highly privileged part of an organization’s network-security environment, with potential implications for firewall policies, administrative accounts, network configurations, and security telemetry. Older R80, R80.10, R80.20, R80.30, R80.40, and R81 versi
-
update from securityweek.com
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
securityweek.com · 26d ago · September 17th, 2026
Tracked as CVE-2026-76460 (CVSS score of 10/10), the security defect impacts an API endpoint of the appliance, which does not apply sufficient authentication controls. Both Cisco ISE and ISE Passive Identity Connector (ISE-PIC) are affected, regardless of device configuration. While no workarounds exist, using infrastructure access control lists (iACLs) to restrict traffic to the affected device prevents remote exploitation. “The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco has not shared any information on who is behind the attacks. Cybercriminals and state-sponsored threat actors regularly target vulnerabilities in the company’s products. To hunt for potential compromises, organizations should review ‘access.log’ for suspicious usernames. For distributed deployments, the logs for each node sho
-
update from bleepingcomputer.com
Cisco warns of max severity ISE zero-day exploited in attacks
bleepingcomputer.com · 26d ago · September 17th, 2026
Cisco ISE is a centralized policy platform that IT administrators use to manage endpoints, users, and device access to network resources, often while enforcing Zero Trust security models. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability." Because no workarounds exist, applying the security updates is the only recommended course of action to protect networks from ongoing attacks.
-
mentioned by www.bleepingcomputer.com
Cisco warns of max severity ISE zero-day exploited in attacks https:// bleepingcomputer.com/news/security/ cisco-warns-of-identity-service-e
www.bleepingcomputer.com · 26d ago · September 17th, 2026
-
mentioned by zubiqo.com
Cisco released an emergency patch for an actively exploited zero-day in its Identity Services Engine. The CVE-2026-76460 flaw hits a maximum
zubiqo.com · 26d ago · September 17th, 2026
-
mentioned by thecybersecguru.com
🚨 Cisco ISE CVE-2026-76460 is being actively exploited. A CVSS 10.0 authentication bypass lets unauthenticated remote attackers send a craft
thecybersecguru.com · 26d ago · September 17th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-76460: max-severity auth bypass in the Cisco ISE/ISE-PIC API, actively exploited in the wild. Allows arbitrary file upload/downlo
www.bleepingcomputer.com · 26d ago · September 17th, 2026
-
update from cyberpress.org
Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access
cyberpress.org · 26d ago · September 17th, 2026
Cisco’s Product Security Incident Response Team (PSIRT) confirmed it is aware o
-
mentioned by gbhackers.com
Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access
gbhackers.com · 26d ago · September 17th, 2026
-
mentioned by radar.offseq.com
CVE-2026-76460: CRITICAL auth bypass in Cisco ISE & ISE-PIC is actively exploited. Remote attackers can gain admin access via crafted API re
radar.offseq.com · 26d ago · September 17th, 2026
-
mentioned by bugstoday.com
https://bugstoday.com/cisco-ise-has-a-cvss-10-zero-day-attackers-are-already-inside/ # Cybersecurity # InfoSec # CVE # Vulnerability # Security
bugstoday.com · 26d ago · September 17th, 2026
-
mentioned by bugstoday.com
Cisco ISE has a CVSS 10 zero-day, attackers are already inside
bugstoday.com · 26d ago · September 17th, 2026
-
update from theperimetersite.com
Your phone vibrates at 3am. It's a critical alert from your network access control. Someone just bypassed authentication on your Identity Se
theperimetersite.com · 26d ago · September 17th, 2026
Your phone vibrates at 3am. Someone just bypassed authentication on your Identity Se
via Mastodon https://theperimetersite.com/report/271
-
update from securityweek.com
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
securityweek.com · 26d ago · September 17th, 2026
submitted by /u/sunychoudhary [link] [comments]
via reddit r/cybersecurity: Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
-
update from securebulletin.com
Critical Check Point Login Flaw Exposes Management Servers to Root Takeover # CyberSecurity https:// securebulletin.com/critical-ch eck-poin
securebulletin.com · 26d ago · September 17th, 2026
Critical Check Point Login Flaw Exposes Management Servers to Root Takeover # CyberSecurity https:// securebulletin.com/critical-ch eck-poin
via Mastodon https://securebulletin.com/critical-check-point-login-flaw-exposes-management-servers-to-root-takeover/
-
update from securityweek.com
Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard
securityweek.com · 26d ago · September 17th, 2026
Cisco on Wednesday announced patches for dozens of critical-severity CVEs in Secure Firewall Management Center (FMC), Identity Services Engine (ISE), and Nexus Dashboard. Three of the issues have already been publicly disclosed, Cisco warned. CVE-2026-20284 is a critical-severity insufficient validation of user-supplied input that can allow attackers to view or modify data and cause a denial-of-service (DoS) condition. Multiple other critical-severity flaws related to injection, XSS, bypass, information disclosure, path traversal, and related attacks th
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-76460 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 26d ago · September 17th, 2026
-
mentioned by bleepingcomputer.com
Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
bleepingcomputer.com · 26d ago · September 17th, 2026
-
update from beyondmachines.net
Cisco Patches 21 Flaws in ISE Identity Infrastructure Including Actively Exploited Zero-Days Cisco released a set of security updates for Id
beyondmachines.net · 26d ago · September 17th, 2026
Cisco Patches 21 Flaws in ISE Identity Infrastructure Including Actively Exploited Zero-Days Cisco released a set of security updates for Id
via Mastodon https://beyondmachines.net/event_details/cisco-patches-21-flaws-in-ise-identity-infrastructure-including-actively-exploited-zero-days-e-2-9-l-x/gD2P6Ple2L
-
mentioned by cyber.netsecops.io
📰 Cisco ISE Zero-Day (CVSS 10.0) Under Active Attack, Bypasses Auth Cisco warns of a critical (CVSS 10.0) zero-day in Identity Services Engi
cyber.netsecops.io · 26d ago · September 17th, 2026
-
mentioned by malware.news
Cisco security advisory (AV26-932)
malware.news · 26d ago · September 17th, 2026
-
mentioned by beyondmachines.net
Cisco Patches 18 Critical and High-Severity Firewall Vulnerabilities, One Actively Exploited Cisco released a massive security hardening upd
beyondmachines.net · 26d ago · September 17th, 2026
-
update from malware.news
AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460
malware.news · 26d ago · September 17th, 2026
Number: AL26-021 Date: September 17, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.
-
mentioned by malware.news
CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation
malware.news · 26d ago · September 17th, 2026
-
update from dev.to
Patching the Check Point VPN flaws: a prioritized response plan for CVE-2026-85102 and CVE-2026-85103 When CERT-In issued note CIVN-2026-045
dev.to · 26d ago · September 17th, 2026
Patching the Check Point VPN flaws: a prioritized response plan for CVE-2026-85102 and CVE-2026-85103 When CERT-In issued note CIVN-2026-045
via Mastodon https://dev.to/stark_zhuang_df5076f35c68/patching-the-check-point-vpn-flaws-a-prioritized-response-plan-for-cve-2026-85102-and-2bhp
-
mentioned by malware.news
Check Point security advisory (AV26-933)
malware.news · 26d ago · September 17th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Vulnerability | CRITICAL CVEs: CVE
www.yazoul.net · 26d ago · September 17th, 2026
-
mentioned by insomnisec.com
Cisco's Back-to-Back Zero-Days: CVE-2026-76461 (Secure Email Gateway) and CVE-2026-76460 (ISE Auth Bypass) If your organization runs Cisco n
insomnisec.com · 26d ago · September 17th, 2026
-
update from socprime.com
CVE-2026-76460: Critical Cisco ISE Zero-Day Authentication Bypass Exploited in the Wild
socprime.com · 26d ago · September 17th, 2026
That level of access can allow a threat actor to alter the system and potentially remove or conceal evidence of compromise, complicating forensic investigation. The same day, CISA added it to the Known Exploited Vulnerabilities catalog and gave U.S. federal civilian agencies until September 19, 2026 to remediate affected systems. Contact Sales CVE-2026-76460 analysis From a defensive perspective, CVE-2026-76460 analysis starts with the vulnerable management API.
-
update from cyberscoop.com
Cisco alerts customers to second actively exploited zero-day in as many days
cyberscoop.com · 26d ago · September 17th, 2026
Cisco disclosed its second actively exploited zero-day vulnerability in as many days, presenting its customers with back-to-back threats to address in unrelated products. “ISE devices enforce network access policy, so root access on the appliance lets an attacker modify that policy, extract stored credentials, delete logs, and move laterally into every network segment ISE controls,” Landon Rice, senior exploit developer at VulnCheck, told CyberScoop. Cisco did not say how many organizations have been compromised thus far, but reported it found the vulnerability during a technical support case. We strongly recommend customers upgrade to available fixed software and follow guidance in the advisory,” a Cisco spokesperson said in a statement. Researchers haven’t attributed attacks involving CVE-2026-76460 to any known group or threat actor, but Rice noted Cisco ISE vulnerabilities are a recurring target.
-
update from cyberscoop.com
Cisco Confirms Second Zero-Day Actively Exploited in Two Days
cyberscoop.com · 26d ago · September 17th, 2026
Cisco's advisory batch included 77 new CVEs total, with 41 affecting ISE and 28 affecting Secure Firewall products.
-
mentioned by www.networkworld.com
"Cisco patches max-severity ISE flaw, the second critical zero-day this week" "Cisco released patches for an actively exploited authenticati
www.networkworld.com · 26d ago · September 17th, 2026
-
mentioned by bleepingcomputer.com
Cisco warns of max severity ISE zero-day exploited in attacks
bleepingcomputer.com · 26d ago · September 17th, 2026
-
update from link.is.it
Apply Cisco Identity Services Engine security updates immediately — do not schedule this one for next Tuesday. Reward: A blinking cursor. It
link.is.it · 26d ago · September 18th, 2026
Apply Cisco Identity Services Engine security updates immediately — do not schedule this one for next Tuesday. Reward: A blinking cursor.
-
mentioned by threatnoir.com
⚠️ CRITICAL: Cisco alerts customers to second actively exploited zero-day in as many days Cisco ISE zero-day CVE-2026-76460 is actively expl
threatnoir.com · 26d ago · September 18th, 2026
-
update from theperimetersite.com
Cisco's been spending a few days tidying up, but it's doing so while the front door is getting kicked in, and the number of patches they dro
theperimetersite.com · 25d ago · September 18th, 2026
Cisco's been spending a few days tidying up, but it's doing so while the front door is getting kicked in, and the number of patches they dro
via Mastodon https://theperimetersite.com/report/274
-
update from securityweek.com
Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
securityweek.com · 25d ago · September 18th, 2026
Nevertheless, it has shared some potential indicators of compromise (IoCs). Tanium published five new advisories this week to inform customers about high- and medium-severity vulnerabilities. In Tanium Asset, the company fixed two high-severity SQL injection vulnerabilities that authenticated attackers can exploit to gain read and write access to restricted data, or tamper with SQL queries executed by the service.
-
mentioned by thehackernews.com
🤖 CVE-2026-91843 (CVSS 9.8): pre-auth stack overflow in Check Point Security Management login process lets unauthenticated attackers run cod
thehackernews.com · 25d ago · September 18th, 2026
-
mentioned by beyondmachines.net
Critical Check Point Management Flaw Allows Unauthenticated Remote Root Access Check Point issued an patch for a critical stack overflow vul
beyondmachines.net · 25d ago · September 18th, 2026
-
update from bleepingcomputer.com
Check Point flaw lets hackers execute code with root privileges
bleepingcomputer.com · 25d ago · September 18th, 2026
Check Point also provided temporary mitigation measures for customers who can't deploy the latest LivePatch, including hardening vulnerable systems against attacks and limiting access to trusted IP addresses/subnets by editing the entries under Manage & Settings > Permissions & Administrators > Trusted Clients in the SmartConsole dashboard. While the company has not yet flagged this security flaw as actively exploited, it said security teams can identify CVE-2026-91843 attacks by looking for "Administrator failed to log in: Username too long" alerts in the Audit and Admin login logs.
-
mentioned by www.bleepingcomputer.com
New Check Point flaw lets hackers execute code with root privileges https:// bleepingcomputer.com/news/security/ check-point-warns-critical-
www.bleepingcomputer.com · 25d ago · September 18th, 2026
-
mentioned by bleepingcomputer.com
Check Point flaw lets hackers execute code with root privileges
bleepingcomputer.com · 25d ago · September 18th, 2026
-
mentioned by threat-intelligence.redeyesecurity.com
Cisco ISE zero-day CVE-2026-76460: attackers get root on the network policy engine. ISE decides who and what gets onto the network. Root on
threat-intelligence.redeyesecurity.com · 25d ago · September 18th, 2026
-
mentioned by forum.hashpwn.net
Cisco ISE zero-day CVE-2026-76460 is being actively exploited. The CVSS 10.0 flaw allows remote, unauthenticated attackers to bypass authent
forum.hashpwn.net · 25d ago · September 18th, 2026
-
mentioned by dev.to
1. Basic Information Title: Cisco Identity Services Engine Authentication Bypass... # security # threatintel # software # coding # developme
dev.to · 25d ago · September 18th, 2026
-
mentioned by cyber.netsecops.io
📰 Check Point Patches Critical RCE Flaw in Management Servers Check Point patches critical RCE flaw (CVE-2026-91843, CVSS 9.8) in Security M
cyber.netsecops.io · 25d ago · September 18th, 2026
-
mentioned by cyber.netsecops.io
📰 Cisco ISE Zero-Day (CVSS 10.0) Under Active Attack, Bypasses Auth Cisco warns of a critical (CVSS 10.0) zero-day in Identity Services Engi
cyber.netsecops.io · 25d ago · September 18th, 2026
-
mentioned by www.bleepingcomputer.com
# Cisco warns of max severity # ISE zero-day exploited in attacks https://www. bleepingcomputer.com/news/secu rity/cisco-warns-of-identity-s
www.bleepingcomputer.com · 25d ago · September 18th, 2026
-
mentioned by thehackernews.com
https:// thehackernews.com/2026/09/crit ical-check-point-management-server.html # CheckPoint # CyberSecurity # CriticalVulnerability # RCE #
thehackernews.com · 25d ago · September 18th, 2026
-
mentioned by www.darkreading.com
🤖 CVE-2026-76460 (CVSS 10.0): authentication bypass in Cisco Identity Services Engine (ISE) API endpoints. Zero-day, maximum severity rating
www.darkreading.com · 25d ago · September 18th, 2026
-
mentioned by www.darkreading.com
🤖 CVE-2026-76460 (CVSS 10.0): authentication bypass zero-day in Cisco Identity Services Engine (ISE), rated maximum severity. Flawed API end
www.darkreading.com · 24d ago · September 19th, 2026
-
mentioned by suriq.io
🔴 EXPLOITED Cisco Identity Services Engine has a second CVSS 10 zero-day under active attack: CVE-2026-76460, an unauthenticated API auth by
suriq.io · 24d ago · September 19th, 2026
-
mentioned by www.bleepingcomputer.com
New # CheckPoint flaw lets hackers execute code with root privileges https://www. bleepingcomputer.com/news/secu rity/check-point-warns-crit
www.bleepingcomputer.com · 24d ago · September 19th, 2026
-
mentioned by threatnoir.com
2026-W38 — Weekly Threat Roundup 🔓 Cisco ISE (CVE-2026-76460) and Check Point (CVE-2026-91843) zero-days are actively exploited this week, d
threatnoir.com · 23d ago · September 20th, 2026
-
update from community.checkpoint.com
RE: Additional details about mitigation actions related to Check Point Management Server
community.checkpoint.com · 23d ago · September 20th, 2026
RE: https:// infosec.exchange/@threatnoir/1 17301661251550972 For additional details about mitigation actions related to Check Point Management Server
via Mastodon https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409#M47058
-
mentioned by insomnisec.com
Check Point CVE-2026-91843: Unauthenticated Root Code Execution in Security Management and Log Servers If your organization runs Check Point
insomnisec.com · 23d ago · September 20th, 2026
-
mentioned by diesec.com
CVE-2026-76460 (CVSS 10.0): unauth attackers skip login on Cisco ISE, reach root. Active exploitation confirmed. 2nd Cisco zero-day this wee
diesec.com · 21d ago · September 22nd, 2026
-
update from suriq.io
Cisco ISE and Kong Gateway had the week's marquee flaws, and both were auth bypasses in the identity appliances themselves (two Cisco bugs C
suriq.io · 21d ago · September 22nd, 2026
Cisco ISE and Kong Gateway had the week's marquee flaws, and both were auth bypasses in the identity appliances themselves (two Cisco bugs C
via Mastodon https://suriq.io/blog/signal-gatekeeper-was-the-target
-
mentioned by cybersecurefox.com
CVE-2026-76460: Cisco ISE authentication bypass with CVSS 10.0 🔗 https:// cybersecurefox.com/en/cve-2026 -76460-cisco-ise-authentication-byp
cybersecurefox.com · 21d ago · September 22nd, 2026
-
mentioned by securityonline.info
An exploited Check Point VPN vulnerability allows remote code execution. Patch this Check Point VPN vulnerability now to block active in-the
securityonline.info · 21d ago · September 22nd, 2026
-
update from medium.com
Cisco ISE scores a perfect CVSS 10.0 — unauthenticated API bypass to root (CVE-2026-76460)
medium.com · 19d ago · September 24th, 2026
This one is as bad as it sounds. No creds, no user interaction, no complexity. Every supported ISE version (3.1 through 3.51) is affected. The kicker: Cisco explicitly says there are NO workarounds. You patch or you accept the risk. No ACL, no WAF rule, nothing. CISA KEV listed it September 16, four days after patch release. ISE is your NAC platform. Compromising it means controlling network access for your entire environment. Patch this weekend.