Security news, decoded.

Cisco says CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), is being exploited in the wild. A crafted request to an affected API can let an unauthenticated remote attacker bypass the web management interface and potentially obtain root-level command execution. Update to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4; Cisco reports no workaround.

Cisco has issued emergency fixes for CVE-2026-76460, a CVSS 10/10 authentication bypass in an API endpoint affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which is being exploited in the wild. Crafted API requests can bypass the web management interface, potentially grant device access and permit root-level command execution; organizations should upgrade to ISE or ISE-PIC versions 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12 and investigate affected nodes for compromise.

Researchers released the BragJack proof of concept, showing how malicious browser extensions could seize control of built-in AI agents in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. The flaws, including CVE-2026-0628 in Chrome and CVE-2026-55945 in Edge, could enable access to sensitive data and actions on authenticated websites; the affected vendors have addressed the reported issues.

Attackers are exploiting CVE-2026-89026 in Issabel Framework, affecting Issabel PBX, to execute operating-system commands remotely without authentication. The flaw uses a JWT signing key shared across installations, allowing forged tokens to invoke Asterisk functionality and run commands as the Asterisk user. A patch released on August 1, 2026 moves the key into "/etc/issabel.conf"; users should apply the latest fixes.

Kaspersky reports that NightEagle (APT-Q-95), Hacking Cat, and Toy Ghouls have targeted Russian enterprises with backdoors, ransomware, and destructive malware. NightEagle compromised Microsoft Exchange Server and exploited CVE-2019-0708 for lateral movement, while Hacking Cat abused Microsoft Exchange vulnerabilities CVE-2021-26855 and CVE-2026-42897 to deploy Gorilla RAT and Monkey ransomware. Toy Ghouls used WinRM to install Bird Agent backdoors that use MQTT or Matrix-based Element communications, increasing the risk of persistent access across affected networks.

Forever Security published a proof of concept showing that a malicious browser extension with common permissions could hijack AI assistants in Chrome, Comet, Edge, Opera Neon, and Claude in Chrome. The demonstrated attacks could make agents act for an attacker; Chrome and Comet could also expose local files, while Chrome could enable camera and microphone access. Google fixed CVE-2026-0628 in Chrome version 143.0.7499.192, and Microsoft fixed CVE-2026-55945 in Edge version 150.0.4078.48; the remaining findings have no CVE, and no in-the-wild exploitation has been reported.

Oracle’s September 2026 Critical Security Patch Update fixes 673 vulnerabilities across product lines including Oracle E-Business Suite, Oracle Fusion Middleware, and Oracle Database. The release includes 104 critical-rated issues; Oracle E-Business Suite received 159 fixes, including network-reachable CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462, each with a CVSS score of 9.8. Oracle Fusion Middleware received 153 patches, 78 of which can be exploited remotely without authentication, while Oracle Database products received 13 updates.

A public PoC for CVE-2026-90894 shows how a non-admin local user can gain root privileges on a Mac running vulnerable Parallels Desktop for Mac. The flaw abuses appliance extraction to inject tar options through the root-run prldispservice, affecting builds below Parallels Desktop 27.0.0. JFrog identifies version 27.0.0 as fixed, but Intel Macs cannot install the 27.x line and may remain without a confirmed fix on Parallels Desktop 26.

Google has patched CVE-2026-58704, a high-severity zero-day in the Google Pixel cellular modem that has seen limited, targeted exploitation. A logic flaw can let a nearby attacker bypass permissions and gain elevated privileges without user interaction. The latest Pixel updates also address more than 100 additional device-specific vulnerabilities, so affected owners should install them promptly.

A public proof of concept has highlighted CVE-2026-90894, also known as ParaShells, an argument injection issue in Parallels Desktop for Mac v26.4.0 on Apple ARM-based macOS systems. A low-privileged local user can abuse the root-running prldispservice to obtain root access, potentially exposing other users' data and enabling persistence; Parallels fixed the flaw in Parallels Desktop v27.0.0, so organizations should upgrade.

StellarWP has patched two unauthenticated remote code execution flaws in The Events Calendar plugin for WordPress: CVE-2026-78159 and CVE-2026-78006, both rated CVSS 9.8. The bugs can allow code or PHP object injection and could result in a complete WordPress site takeover when event comments are enabled. Administrators should update to The Events Calendar 6.17.4.1, as versions before 6.17.3.1 are exposed to both issues and CVE-2026-78006 is fixed in 6.17.4.1.

Google has patched CVE-2026-58704, an actively exploited privilege-escalation vulnerability in the Pixel Cellular Modem. The logic flaw can bypass permissions and allow a nearby attacker to gain elevated privileges without user interaction; Google says exploitation appears limited and targeted. September 2026 Pixel updates also address 109 other Android and Pixel issues, including CVE-2026-56914 and CVE-2026-58773; install security patch level 2026-09-05 or later.

CISA has added ConnectWise ScreenConnect vulnerability CVE-2026-84869 to its Known Exploited Vulnerabilities catalog after attacks began targeting the flaw. The missing-authorization and privilege-management issue affects ScreenConnect clients before version 26.6.5 and can let attackers with basic privileges transfer or run files during active remote sessions without host confirmation. Organizations should update to ScreenConnect 26.6.5 or later, as exposed unpatched instances remain reachable online.

Acronis says CVE-2026-87886 has been used in limited, targeted attacks against its Backup plugin for cPanel & WHM and Backup extension for Plesk. The insecure file permissions issue affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, allowing a low-privileged local attacker to elevate privileges and potentially run arbitrary code; update to 1.9.3 HF3 and the latest Plesk release.

Google's Chrome 153 fixes 42 security flaws, including CVE-2026-91726 in WebGL and use-after-free vulnerabilities CVE-2026-91721 and CVE-2026-91749; the release is rolling out as 153.0.8010.47/.48 for Windows and macOS and 153.0.8010.47 for Linux. Mozilla's Firefox 156 addresses 73 vulnerabilities, with related fixes also available in Thunderbird 156 and 140.16 and Firefox ESR 153.3, 140.16, and 115.41; neither vendor reports exploitation, but users should update promptly.

Kaspersky reports that the NightEagle APT group targeted Russian organizations, using stolen VPN credentials and deploying the GhostContainer backdoor on Microsoft Exchange Server. The attackers used Microsoft dev tunnels, rdp2tcp, and Active Directory techniques to sustain access and move through victim networks, while exploiting CVE-2019-0708 (BlueKeep) in at least one incident. The activity can lead to domain controller compromise and exposure of the wider Active Directory environment.

Acronis has released urgent fixes for CVE-2026-87886, an insecure file permissions vulnerability exploited in targeted attacks against the Backup plugin for cPanel & WHM. The flaw can enable local privilege escalation in Linux versions before build 1.9.3.1021 and also affects the Backup extension for Plesk before build 1.8.11.638, though exploitation has not been reported for Plesk; administrators should update immediately.

Acronis says CVE-2026-87886 is being exploited in targeted attacks against its Backup plugin for cPanel & WHM. Insecure file permissions let authenticated attackers elevate privileges locally on Linux servers; administrators should update the cPanel & WHM plugin to version 1.9.3 HF3 and the Backup extension for Plesk to version 1.8.11, though no Plesk exploitation has been observed.

Attackers are exploiting CVE-2026-5430, a CVSS 10 WSO2 vulnerability patched in April, to bypass JWT authentication and gain unauthorized access. The flaw affects API Manager, Traffic Manager, Universal Gateway, and API Control Plane, and may enable administrative account takeover, access to API credentials and secrets, and interception of sensitive data. Organizations using affected WSO2 products should apply the available patch promptly.

Google has issued its September 2026 Pixel updates, fixing 110 flaws including CVE-2026-58704, a high-severity zero-day under limited targeted exploitation. The Pixel Cellular Modem issue could let an attacker on an adjacent network bypass permissions and elevate privileges without user interaction; affected users should install the 2026-09-05 security update.

Attackers are actively exploiting CVE-2026-27540 in WooCommerce Wholesale Lead Capture, affecting all versions up to and including 2.0.3.1. The missing file-type validation lets unauthenticated attackers upload PHP web shells, enabling remote code execution and further compromise of WordPress sites. Separately, The Events Calendar is affected by CVE-2026-78159 in versions <= 6.17.3 and CVE-2026-78006 in versions <= 6.17.4; both can lead to unauthenticated remote code execution when event comments are enabled. StellarWP fixed these issues in versions 6.17.3.1 and 6.17.4.1, while WooCommerce Wholesale Lead Capture users should investigate unexpected PHP files and suspicious wwlcfileuploadhandler requests.

Active exploitation attempts are targeting CVE-2026-5430, a JWT signature-validation bypass in WSO2 API Control Plane 4.6.0 and 4.5.0; WSO2 API Manager 4.6.0, 4.5.0, 4.4.0, 4.3.0, 4.2.0, and 4.1.0; WSO2 Traffic Manager 4.6.0 and 4.5.0; and WSO2 Universal Gateway 4.6.0 and 4.5.0. Attackers can submit forged tokens with administrator privileges to bypass authentication, potentially exposing API backends, credentials, consumer keys, secrets, and internal services; users should apply WSO2's available fixes immediately.

Acronis has warned that CVE-2026-87886, a Linux local privilege-escalation flaw with a CVSS score of 7.8, has been used in limited targeted attacks against Acronis Backup plugin for cPanel & WHM deployments. The vulnerability affects Acronis Backup plugin for cPanel & WHM builds earlier than 1.9.3.1021 and Acronis Backup extension for Plesk builds earlier than 1.8.11.638, allowing a low-privileged attacker to raise permissions and potentially access or alter sensitive data. Acronis fixed the issue in Acronis Backup plugin for cPanel & WHM version 1.9.3 HF3 and Acronis Backup extension for Plesk version 1.8.11; administrators should update promptly.

Attackers are actively exploiting CVE-2026-27540 in AutoPlugins LLC's WooCommerce Wholesale Lead Capture for WordPress versions 2.0.3.1 and older. The unauthenticated file-upload flaw lets attackers upload PHP webshells, execute code, and potentially take over affected WordPress sites; administrators should upgrade to version 2.0.3.2 or later and investigate unexpected PHP uploads and related AJAX requests.

A Picus Security analysis examines the late-August attacks on PaperCut NG and PaperCut MF, where attackers exploited servers before PaperCut had issued a lasting fix. The incident had no assigned CVE ID and no public proof of concept at first, while an initial emergency patch was bypassed and a third release arrived on September 1. It highlights the need to validate exposure and compensating controls quickly when active exploitation begins before patching or conventional exploit testing is possible.

Attackers breached Thai broadband provider 3BB by exploiting FortiGate SSL-VPN vulnerability CVE-2024-21762 after probing CVE-2018-13379, CVE-2022-42475, and CVE-2023-27997. They also investigated 3BB's F5 BIG-IP environment for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, then used MeshCentral, Linux privilege-escalation tools, credential theft, web shells, and log cleanup to maintain access. The incident shows how exposed edge appliances can provide a path to persistent access across a provider's internal network.

CISA says ransomware gangs are actively exploiting CVE-2026-59310 in VMware vCenter Server, a vulnerability Broadcom patched in July. The directory traversal flaw in the vCenter Syslog server can let unauthenticated attackers execute arbitrary code, putting organizations' virtual infrastructure and connected internal systems at risk.

Sysdig observed a human-operated attack exploiting CVE-2026-39987, a pre-authentication RCE flaw affecting all versions of Marimo, to obtain AWS credentials and reach an SSH bastion host in eight seconds. The activity shows how rapidly operators can turn exposed notebook services into cloud access; separately, Hunt.io reported a cryptomining campaign compromising 3,562 Redis servers through unauthenticated rogue replication and deploying XMRig.

Cisco has released fixes for CVE-2026-76461, an actively exploited SQL injection flaw affecting Cisco Secure Email Gateway appliances running Cisco AsyncOS Software versions 16.5, 16.0, and 15.5 and earlier. A remote, unauthenticated attacker can send a crafted email to execute SQL commands and potentially gain root-level command execution without user interaction; Cisco Secure Email Cloud was also affected, and its devices have been upgraded to Release 16.5.0-780. Administrators should update to 15.5.5-014, 16.0.4-302, or preferably 16.5.0-780, then review device, network, and firewall logs because attackers may remove evidence of compromise.

cPanel issued an advisory warning that a critical vulnerability in LiteSpeed Web Server Enterprise versions prior to 6.3.7 allows low-privilege users to escalate privileges and gain root access on shared hosting servers. This flaw enables attackers to bypass containment controls like CageFS, potentially compromising other websites hosted on the same machine. Administrators are urged to manually update to version 6.3.7 using the provided script, as automatic updates may be delayed.

Cisco has disclosed active in-the-wild exploitation of CVE-2026-76461, a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway that enables unauthenticated remote attackers to execute arbitrary commands with root privileges. With a CVSS score of 9.8, the flaw stems from insufficient validation in email parsing logic, allowing malicious SQL statements to be injected via crafted messages. Patches have been released for affected releases, including fixes in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. Administrators are urged to update immediately and review mail logs for signs of compromise, as threat actors may attempt to hide their tracks due to the elevated access gained.

Chinese state-sponsored groups including UTA0560 and APT31 have been observed exploiting a multi-stage attack chain targeting recent vulnerabilities in Google Chrome and Microsoft Windows. The campaign leverages CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to breach non-governmental organizations and deploy backdoors such as GRIMWEDGE and LONGTALE. This incident highlights significant risks associated with patch gaps where fixes exist in upstream sources but have not yet propagated to stable consumer releases.

Cisco has disclosed that a critical zero-day vulnerability, tracked as CVE-2026-76461, is currently being actively exploited against its Secure Email Gateway appliances. With a CVSS score of 9.8, this flaw in the AsyncOS software enables unauthenticated attackers to achieve root-level access and execute arbitrary commands by sending specially crafted emails containing malicious SQL statements. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to remediate the issue urgently. While specific threat actors have not been identified, the exploitation highlights severe risks for both physical and virtual instances of the Secure Email Gateway.

Researchers confirm that Sandworm-linked actors are actively exploiting two vulnerabilities in Cisco Secure Firewall Management Center (FMC) to deploy an updated version of the Cyclops Blink malware implant. By chaining a maximum severity authentication bypass flaw (CVE-2026-20079) with a secondary privilege escalation bug (CVE-2026-20316), the threat actor establishes a reverse shell before installing the 64-bit Linux-capable malware. This newer variant expands traditional capabilities to include active network scanning and live traffic capture, posing a significant risk to organizations relying on these appliances for network management. Cisco has released emergency hotfixes for both CVEs and urges immediate application due to confirmed in-the-wild exploitation, with a broader hardening release expected shortly.

Threat actors are actively exploiting CVE-2026-85706, a critical path traversal vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on September 14, 2026. This flaw, which carries a CVSS score of 10.0, permits unauthenticated users to read arbitrary files from self-hosted instances of GitLab Community Edition and Enterprise Edition. Researchers at watchTowr confirmed that attackers have escalated probes into full exploitation, successfully exfiltrating configuration and SSH files to potentially steal credentials and access development environments. To mitigate this risk, organizations must update their self-hosted GitLab instances to versions 19.3.2, 19.2.6, or 19.1.8 immediately. If updates are not possible, administrators should restrict public access to their instances and audit repository commits API logs for unauthenticated requests.

Apple has rolled out a comprehensive suite of security updates for its entire ecosystem, including iOS, macOS, iPadOS, watchOS, visionOS, and tvOS. The release addresses a massive list of Common Vulnerabilities and Exposures (CVEs), ranging from kernel memory corruption and privilege escalation flaws to significant bugs in WebKit, ImageIO, and the Kernel. Notable fixes include CVE-2026-43689 and CVE-2026-43786, which allow apps to gain root privileges, and multiple issues such as CVE-2026-43686 that enable kernel memory corruption via malicious NFS servers. Users are strongly advised to install these updates immediately to protect against potential exploits involving sensitive data leakage, remote code execution, and system instability.

Thai broadband provider 3BB was infiltrated by an attacker who maintained persistent root access using a hidden MeshCentral backdoor, according to findings published by Hunt.io. The intrusion involved the use of a full exploit toolkit for the Fortinet FortiGate SSL-VPN gateway, specifically targeting CVE-2024-21762 on the mail.3bb.co.th host, although researchers noted it remains unconfirmed whether this specific vulnerability was used for initial entry. While evidence shows the attackers targeted 3BB’s RADIUS databases for subscriber credentials and probed related infrastructure belonging to Jasmine, there is no confirmation that customer data was exfiltrated. Organizations are advised to audit for unauthorized MeshCentral agents, rotate exposed credentials, and ensure FortiGate devices are patched against CVE-2024-21762.

A suspected Chinese state-linked threat actor named Red Heron has actively exploited the critical remote code execution vulnerability CVE-2026-60004 in Gitea, resulting in confirmed compromises across thirteen organizations in six countries. The campaign, which began shortly after the flaw's disclosure, involves automated scanning and exploitation to steal source code, credentials, and internal infrastructure details from victims in sectors such as defense, energy, and government. The attackers deployed a Linux implant called JITTERLY along with a newly discovered LDPRELOAD rootkit named SIXZUT to maintain persistence and evade detection by hiding processes and files. Analysis indicates that the group achieved root-level access on some victim networks, including moving laterally through a three-node Proxmox cluster in Taiwan.