AI-generated editorial illustration; not a documentary photograph.
Cisco has warned that CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine (ISE), is being actively exploited. The flaw carries a CVSS score of 10.0 and could let an unauthenticated remote attacker bypass the product's web management interface through a crafted API request.
Cisco ISE Under Attack
Cisco attributed the vulnerability to insufficient authentication controls on an API endpoint. Successful exploitation could give an attacker unauthorized access to an affected device without valid credentials. The September 21 recap does not specify affected ISE versions or provide detailed remediation instructions, so administrators need to consult Cisco's advisory for deployment-specific guidance.
AI Coding Agents Exposed
AIR Security separately demonstrated Plugin4Shell, which it described as a zero-click remote code execution flaw affecting Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI. According to the researchers, an attacker controlling a plugin repository could cause malicious code to be retrieved even though the agent appeared to honor a marketplace-pinned commit.
The finding concerns developers who install trusted plugins through these agents because the reported weakness sits in how the client validates the checked-out code. AIR Security said users must update their agents, but the recap does not name corrected versions or independently assess the exploit across each product.
ClickFix Spreads Through Brevo
Brevo said an attacker used a compromised Cloudflare API key on September 14, 2026, to deploy a Worker that injected malicious code into its domains and three JavaScript files embedded by customers. The Worker remained active for about five and a half hours, and the incident affected more than 100,000 customer sites, according to the report.
The injected script presented selected visitors with a fake Cloudflare CAPTCHA that instructed them to paste and execute a malicious command, a social-engineering method known as ClickFix. Sansec reported that the campaign also used embedded Brevo widgets to install WordPress malware when site administrators visited affected sites.
A Broader ClickFix Pattern
Other reported campaigns used legitimate-looking browser workflows to deliver similar traps. Huntress described a malicious Google Doc sidebar that offered fake remediation steps for a supposed decryption error, while Cisco Talos reported cryptocurrency theft lures that persuaded targets to paste JavaScript into Chrome or install it through Tampermonkey.
Source: ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
SIGNAL TITANS
Leave a Reply