Loki Intelligence — Security Briefs · Published
Daily Brief: Cisco ISE Zero-Day, PBX Exploits, and Mobile and Hosting Flaws
A maximum-severity, actively exploited Cisco ISE flaw puts network access control infrastructure at the top of the day's priorities, alongside exploited telephony, mobile, and hosting software. Teams should upgrade ISE and restrict its management plane, close the remaining KEV gaps, and confirm patches actually landed rather than assuming they did.
Signal 01 · The Hacker News
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco warns that CVE-2026-76460 (CVSS 10.0), an authentication bypass in an Identity Services Engine API endpoint, is being exploited and can lead to root-level access on ISE and ISE-PIC regardless of configuration. Cisco shared log checks and also released fixes for dozens of other critical ISE, firewall, and email flaws.
Why it matters: Upgrade ISE nodes, limit management traffic with infrastructure ACLs, search access logs on every node, and re-image any node showing signs of compromise.
Source: The Hacker News
Signal 02 · The Hacker News
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Exploitation of the Issabel Framework flaw continues: because every installation shared the same JWT signing key, attackers can forge API tokens and run operating system commands without logging in. Shadowserver first saw exploitation on September 9, while the attackers and the scale of activity remain unknown.
Why it matters: Verify Issabel systems carry the August fix and a unique signing key, and audit other products for vendor-shipped secrets shared across installations.
Source: The Hacker News
Signal 03 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
The KEV entry for Google Pixel's cellular modem flaw, CVE-2026-58704, gives US federal agencies until September 19 to remediate. CISA describes a logic error that can let attackers bypass permission checks and gain elevated privileges on affected devices.
Why it matters: Use the KEV deadline as a benchmark for corporate mobile fleets and verify through MDM that devices report the September 2026 patch level.
Source: CISA
Signal 04 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA's latest pair of KEV additions covers the exploited Cisco ISE privileged API flaw and the Acronis Backup cPanel and Plesk permissions issue, both carrying a September 19 federal remediation deadline. Together they span network access control and shared hosting infrastructure.
Why it matters: Map both products in your asset inventory, patch on or before the KEV deadline, and review logs for suspicious activity that predates the fix.
Source: CISA
Signal 05 · The Hacker News
CISO's Expert Guide to Agentic Pentesting for Websites
A sponsored Reflectiz guide argues annual pentests leave most web assets untested while exploitation timelines shrink to days, citing Verizon, Mandiant, and Cobalt data. It promotes continuous agentic pentesting and lists governance requirements, including provable coverage, independent validation of findings, blast-radius guardrails, and full audit trails.
Why it matters: Before authorizing any autonomous testing tool against production, define its scope, kill switch, data access limits, and logging, and verify its coverage claims.
Source: The Hacker News
Signal 06 · The Hacker News
Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation
Google indicates its Pixel cellular modem bug, CVE-2026-58704, may be under limited, targeted exploitation, and CISA has since added it to KEV. The flaw needs no user interaction to exploit, and the September Pixel bulletin fixes it along with 109 other issues.
Why it matters: Treat zero-click mobile flaws as high priority for executives and other high-risk staff, and enforce minimum patch levels for corporate access.
Source: The Hacker News
Signal 07 · The Hacker News
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis confirmed limited, targeted exploitation of an insecure file permissions flaw in its Linux Backup plugin for cPanel & WHM and its Plesk extension, which lets low-privileged users escalate. CISA has added the bug, CVE-2026-87886, to its KEV catalog.
Why it matters: Shared hosting operators should confirm fixed builds are deployed on every node and review recent privilege changes on servers running the plugin.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.