Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Security activity identified on September 21, 2026, shows attackers repeatedly turning trusted infrastructure into an initial-access mechanism. Management APIs, AI-agent plugins, browser extensions, embedded website scripts and legitimate cloud services all feature in the latest campaigns.

The most urgent issue is CVE-2026-76460, a CVSS 10.0 authentication bypass affecting Cisco Identity Services Engine. Cisco has confirmed active exploitation, while the Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Other immediate risks include unauthenticated code execution in Orkes Conductor, a malformed-image flaw affecting libheif and Discourse, and an AI plugin supply-chain technique capable of silently replacing pinned code.

Cisco ISE API flaw is already being exploited

CVE-2026-76460 affects two products at version 3.1.0:

• Cisco Identity Services Engine 3.1.0
• Cisco Identity Services Engine Passive Identity Connector 3.1.0

The vulnerability originates in inadequate authentication controls on an API endpoint. A remote attacker can submit a crafted request without credentials, bypass authentication and obtain unauthorized access through the web-based management interface.

Its CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That assessment reflects a network-accessible attack requiring low complexity, no privileges and no user action, with potentially severe consequences for confidentiality, integrity and availability. The weakness is classified as CWE-648.

CISA placed the flaw in KEV on September 16, 2026, setting September 19, 2026, as the remediation deadline for US federal agencies. Required actions include following Cisco’s mitigation instructions, BOD 26-04 risk-based patching guidance and CISA’s forensic-triage requirements. Organizations must discontinue use if no effective mitigation is available.

The affected versions are known, but a specific fixed Cisco release is not identified in the available information. Administrators should therefore use the current vendor instructions rather than infer a safe version boundary.

Because exploitation has been confirmed, response should extend beyond patching. Security teams should examine ISE API activity, management-interface exposure and authentication records for unexpected access. Internet-facing or broadly reachable management services deserve first priority.

This is not an isolated KEV development among the associated vendors. Over the previous 90 days, CVE-2025-39682, CVE-2025-39964, CVE-2026-53266, CVE-2026-87886, CVE-2026-76461 and CVE-2026-87491 also entered the catalog across Linux, Google and Cisco products. CVE-2026-76461, another Cisco identifier, was added on September 14, 2026.

Orkes and Discourse face separate remote-code execution paths

The newly disclosed CVE-2026-58138 affects Orkes Conductor 3.21.21 before 3.30.2. It carries a CVSS score of 9.8 and permits unauthenticated attackers to execute operating-system commands through the workflow API.

The problem involves unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true). Before authentication, an attacker can submit inline workflow definitions containing hostile JavaScript or Python expressions.

Affected execution paths include the INLINE, LAMBDA, DO_WHILE and SWITCH task types. Malicious expressions can reach Java reflection or invoke subprocesses directly, converting workflow evaluation into arbitrary command execution.

Orkes Conductor deployments should be upgraded to 3.30.2 or later. Operators should also restrict unauthenticated access to workflow APIs and review submitted definitions for unexpected scripting, reflection, evaluator or subprocess activity.

A different attack surface appears in CVE-2026-32882, a libheif heap buffer over-read triggered by malformed HEIF images. Upstream libheif versions 1.21.2 and earlier are affected, while libheif 1.22.0 is identified as the corrected upstream version.

The error occurs in HeifPixelImage::overlay(). When an overlay child image uses different bit depths for its alpha and color channels, the function indexes the alpha plane using the color-channel stride rather than alpha_stride. In one documented 100×50 image configuration, the resulting out-of-bounds read can extend 3,123 bytes beyond the alpha buffer.

The upstream assessment is CVSS 7.1, but the Discourse security advisory rates its product-level impact at 8.8 and describes remote code execution through image uploads. The scores differ because they evaluate different exploitation contexts.

Patched Discourse releases are 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6. Docker-based installations can be rebuilt through the normal procedure:

./launcher rebuild app

Supported Discourse core releases also place image processing inside a sandbox when the underlying kernel supports it.

Hacktron separately reported chaining the libheif weakness with an SSO misconfiguration to access OpenAI employee ChatGPT accounts and internal repositories. The reported issues were corrected 14 hours after responsible disclosure.

Plugin4Shell breaks trust in pinned AI-agent extensions

Plugin4Shell is a zero-click supply-chain technique affecting four AI coding environments:

• Claude Code
• OpenAI Codex
• GitHub Copilot
• Google Gemini CLI

The attack defeats the protection expected from plugin SHA pinning. An agent checks the commit reference provided by a marketplace, but it does not independently establish that the expected commit was actually obtained from the repository.

An attacker controlling that repository can therefore make the checkout resolve to malicious content while the recorded SHA continues to appear legitimate. The replacement plugin is then installed and executed without requiring a user click.

Affected versions and fixed-version boundaries have not been disclosed. Users must update the agent software according to each provider’s instructions; marketplace-side validation alone cannot address a verification failure inside the client.

Enterprises should treat plugins as executable software dependencies. Repository ownership, write privileges and plugin provenance require the same controls applied to internal packages. Monitoring should also cover processes and outbound network connections created by coding agents, particularly after plugin installation or updates.

ClickFix campaigns move through cloud services and embedded scripts

A Brevo supply-chain compromise demonstrates how one cloud credential can expose both a provider and its customers. On September 14, 2026, an attacker used a compromised Brevo Cloudflare API key to deploy a Worker inside the company’s account.

For approximately five and a half hours, the Worker altered pages on brevo.com, pages on sibforms.com and three JavaScript files embedded by customers. More than 100,000 websites were exposed to the injected code.

Selected visitors saw a counterfeit Cloudflare CAPTCHA instructing them to paste and run a malicious command. Site administrators could also receive a malicious WordPress plugin when visiting their own sites.

This incident is separate from Brevo’s earlier SAML SSO compromise. That operation affected 138 accounts, led to phishing from six accounts and resulted in contact exports from 43 accounts.

Other ClickFix activity used a legitimate Google Doc to target a security researcher. A bound Google Apps Script displayed a custom sidebar with a fabricated decryption error and instructions to paste commands into Terminal. The payload varied by platform: AMOS infostealer for macOS and a PowerShell loader chain for Windows.

A cryptocurrency-stealing campaign used another variation. It retrieved obfuscated JavaScript through the Google Visualization API and attempted to persuade victims to paste code into Chrome or install it through Tampermonkey, which also supplied persistence.

These attacks do not depend on a conventional browser exploit. Their common control point is user instruction. Legitimate CAPTCHA, document-repair and software-update processes do not require users to paste arbitrary code into PowerShell, Terminal, an address bar or an extension console.

Browser access and nearby attacks broaden the exposure

The KREMLIN banking-malware toolkit installs malicious extensions in Google Chrome and Microsoft Edge. Active since at least May 2025 and tracked as REF9334, the operation impersonates roughly a dozen Brazilian banks.

Its multi-stage JavaScript loaders and custom C++ installers deploy extensions capable of stealing credentials, session tokens and other browser-resident data. Suspected victims should have unauthorized extensions removed, browser sessions invalidated and tokens rotated.

Two additional KEV and platform issues require attention. CVE-2026-58704, rated CVSS 8.8, is a permission bypass in the Google Android Cellular Modem. It requires adjacent access but no privileges or user interaction. CISA added it to KEV on September 16, 2026, with a September 19 remediation deadline.

CVE-2026-82079 affects Nintendo Switch releases before 23.0.0. An attacker within wireless range can send crafted traffic to the local wireless subsystem and exploit a stack buffer overflow to execute code using return-oriented programming. Updating to 23.0.0 or later addresses the documented affected range.

Finally, CVE-2026-90894, known as ParaShells, enables local privilege escalation through Parallels Desktop’s root-level prl_disp_service. Until vendor remediation is available, organizations should limit access by untrusted local users and monitor for unusual appliance installation, tar execution or root child processes.

The operational priority is clear: remediate the KEV-listed Cisco and Android flaws first, then address unauthenticated workflow execution, image-processing exposure and compromised software-distribution channels. Trusted interfaces are doing much of the attackers’ work.