A CVSS 10.0 authentication bypass in Cisco ISE is being exploited in the wild with no credentials required. The same week, Mandiant published the first documented case of an AI coding assistant propagating a worm across 100 repositories, and Unit 42 showed that default AWS agent configurations hand credentials to prompt-injection attacks. Identity security in September 2026 means defending both the humans logging in and the machines acting on their behalf.

In the News

Cisco ISE Zero-Day Auth Bypass - CVE-2026-76460, CVSS 10.0, Actively Exploited

Cisco disclosed CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine (ISE) that requires no credentials. An unauthenticated, network-adjacent attacker can reach the ISE admin interface and bypass authentication entirely.

ISE is the network access control and policy-enforcement engine for thousands of enterprises. It decides which users, devices, and workloads are permitted on the network, what VLAN they land on, and what security posture they must meet. Compromising the ISE admin plane gives an attacker the ability to rewrite access policy - effectively controlling who gets network access and who does not.

The vulnerability is actively exploited. Cisco has released a patch. Organizations running ISE should treat this as the highest-priority remediation item today. Beyond patching, restrict ISE admin interface access to a dedicated management VLAN, enforce phishing-resistant authentication (FIDO2) on admin accounts, and deploy identity threat detection to flag anomalous admin sessions.

What defenders should do: Patch CVE-2026-76460 immediately. Restrict ISE admin portal access to management networks only. Audit ISE admin session logs for unauthorized access during the exposure window. Deploy ITDR capabilities that monitor infrastructure admin-plane activity - not just user-account behavior.

Mandiant Documents AI Coding-Assistant Session Hijacking - Shai-Hulud Worm

Mandiant published an incident report describing an attacker who hijacked an active AI coding-assistant session and used it to propagate a worm across approximately 100 internal code repositories. The worm, dubbed Shai-Hulud, harvested secrets and source code from every repository the compromised assistant touched.

The attack surface was session identity. The AI assistant operated with OAuth tokens scoped broadly enough to read and write across the organization’s repository infrastructure. Once the attacker compromised the active session, the assistant’s credentials became the attacker’s credentials - and every code recommendation the assistant made became a propagation vector for the worm.

This incident makes concrete what identity practitioners have warned about: AI agent sessions carry identity, and that identity must be governed with the same rigor as human privileged access. Short-lived session tokens, least-privilege OAuth scopes, and secrets scanning on AI-generated commits are the minimum controls.

What defenders should do: Inventory all AI coding-assistant integrations and their OAuth scopes. Enforce short-TTL session tokens. Require secrets-detection scanning on every commit regardless of whether a human or AI agent authored it. Monitor for anomalous repository access patterns from agent identities.

Plugin4Shell: AI Agent Plugins Swapped Despite Version Pinning

Researchers disclosed Plugin4Shell, a class of supply-chain attack affecting AI coding agents. Repository owners could silently replace plugin code even when the consuming agent had pinned a specific version. Claude Code and OpenAI Codex were both affected; patches have shipped.

The root cause is a familiar one in supply-chain security: plugin identity was bound to the repository owner, not to the code artifact itself. Version pinning - the control developers relied on for immutability - checked the version label, not the underlying code hash. A repository owner who pushed new code under the same version tag bypassed the control entirely.

This repeats the lesson from npm, PyPI, and Docker image registries: repository-level trust is not artifact-level trust. For AI agent workflows, the fix is hash-based artifact verification, code signing, and SBOM generation for every plugin dependency.

What defenders should do: Verify that AI agent plugin dependencies use hash-based integrity verification, not just version pinning. Require code signing for plugins consumed by production agents. Treat AI agent plugin supply chains with the same rigor as application dependency management.

Unit 42: AWS AgentCore Defaults Expose Credentials to Prompt Injection

Palo Alto Unit 42 published research titled “A Vault with a Heap-View” demonstrating that default AWS AgentCore Harness configurations expose credentials to the agent’s prompt-processing context. A crafted prompt-injection attack can exfiltrate credentials that the agent runtime has access to - credentials the agent needs to do its job become credentials the attacker can steal.

The fix is explicit credential isolation: separating the trust boundary between the agent’s prompt-processing runtime and its credential store. This is not enabled by default. Organizations building agents on AWS AgentCore must manually configure credential isolation and apply least-privilege IAM policies to agent roles.

What defenders should do: Review AWS AgentCore Harness configurations for credential isolation. Apply least-privilege IAM policies to all agent roles. Implement secrets management with just-in-time credential access rather than persistent credential availability in the agent runtime.

Defender Action Items

  • Cisco ISE: Patch CVE-2026-76460 immediately. Restrict admin interface to management VLAN. Audit admin session logs for the exposure window. Deploy ITDR on infrastructure admin planes.
  • AI coding agents: Inventory OAuth scopes for all AI assistant integrations. Enforce short-TTL session tokens. Require secrets scanning on AI-generated commits. Verify plugin integrity via hash, not version label.
  • AWS AgentCore: Enable explicit credential isolation in AgentCore Harness. Apply least-privilege IAM to agent roles. Rotate any credentials that were accessible to agents during the default-config exposure window.
  • Check Point: Patch CVE-2026-76461 on Security Management Servers. Restrict management network access. Audit admin accounts for unauthorized policy changes.

Detection Queries

For organizations monitoring ISE admin-plane access, this Splunk SPL query identifies authentication bypass attempts by looking for successful admin sessions without corresponding credential submission events:

index=cisco_ise sourcetype="cisco:ise:syslog"
| search "AdminPortal" AND "Authentication"
| stats count by src_ip, user, result, _time
| where result="Success" AND (isnull(user) OR user="")
| sort -_time

This query surfaces ISE admin portal authentication events where a session succeeded but no username was recorded - a behavioral indicator consistent with authentication bypass. Tune the index and sourcetype to match your ISE syslog ingestion. False positive rate is low in environments where all legitimate admin access uses named accounts.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.