A CVSS 10.0 zero-day in Cisco Identity Services Engine is under active exploitation, giving unauthenticated attackers full administrative access to enterprise NAC deployments. That alone would make this a one-story day. It is not. Check Point’s Security Management Server has a parallel problem - unauthenticated RCE as root on the firewall management plane - and a stolen API key turned 100,000 websites into malware delivery platforms overnight.

Three different attack surfaces. One shared lesson: the infrastructure you trust to enforce security policy is the infrastructure attackers are targeting.

In the News

Cisco ISE Zero-Day CVE-2026-76460 - CVSS 10.0 Authentication Bypass Under Active Exploitation

Cisco has issued an emergency advisory for CVE-2026-76460, a maximum-severity authentication bypass in the Identity Services Engine (ISE) API. The vulnerability allows unauthenticated attackers to bypass authentication on the API endpoint entirely, gaining administrative access to the ISE deployment without credentials.

ISE is the identity and network access control backbone for thousands of enterprise environments. It enforces 802.1X authentication, device posture assessment, and segmentation policy. An attacker with administrative ISE access can modify network access policies, whitelist rogue devices, disable posture enforcement, and pivot into network segments that were supposed to be restricted.

Active exploitation has been confirmed. Cisco has released an emergency patch. There is no workaround that fully mitigates the vulnerability - patching is the only remediation.

What defenders should do: Patch ISE immediately. While the patch is rolling out, restrict API access to the ISE management interface by placing it on a dedicated management VLAN with strict ACLs. Monitor ISE admin audit logs for unfamiliar API authentication events, new administrator accounts, or policy changes that were not authorized through change management. If ISE has been exposed to untrusted networks, treat the deployment as potentially compromised and audit all policy changes since the vulnerability window opened.

Check Point Security Management Server RCE - Unauthenticated Root Access

Check Point disclosed a critical unauthenticated remote code execution vulnerability in its Security Management Server. The flaw allows an attacker with network access to the management server to execute arbitrary commands as root - no authentication required.

The Security Management Server is the centralized control plane for Check Point firewall deployments. It pushes policy to every gateway in the environment. Root access on this server means an attacker can modify firewall rules, disable logging, create VPN tunnels, and effectively own the entire perimeter security stack. No CVE has been assigned yet, but the severity profile - unauthenticated, remote, root-level - is consistent with a CVSS 9.8+ rating.

Check Point has released a LivePatch. No active exploitation has been confirmed, but the attack surface is attractive and the complexity is low.

What defenders should do: Apply the Check Point LivePatch immediately. Verify that the Security Management Server is not reachable from the general network - it should be on an isolated out-of-band management network. Review management server access logs for any connections from unexpected source IPs. This is also a good trigger for a broader architecture review: is your firewall management plane segmented from production traffic?

Brevo Supply-Chain Attack Injects Malware Into 100,000 Websites

Attackers compromised a Cloudflare API key belonging to Brevo, a SaaS email marketing platform, and used it to inject ClickFix malware into over 100,000 customer websites. The attack turned Brevo’s legitimate content delivery infrastructure into a mass malware distribution channel.

The mechanism is straightforward and devastating: Brevo injects marketing scripts into customer websites as part of its service. Once the attackers controlled Brevo’s Cloudflare configuration via the stolen API key, they modified the served content to include ClickFix payloads. Every visitor to an affected customer website received the malware through a trusted delivery path. The websites themselves were never directly compromised - the attack lived entirely in the third-party supply chain.

ClickFix is a social engineering framework that presents victims with fake browser update prompts and CAPTCHA pages designed to trick users into running malicious PowerShell commands. It has been a consistently effective delivery mechanism throughout 2026.

What defenders should do: Audit third-party SaaS integrations that inject scripts or content into your web properties. Implement Content Security Policy (CSP) headers that restrict which domains can serve executable content on your sites. Enforce MFA and secrets rotation on all API keys - particularly those with DNS or CDN configuration access. Monitor for unexpected script injections using Subresource Integrity (SRI) or client-side content integrity monitoring tools.

FamousSparrow Deploys SparroWocky Backdoor Against LatAm Governments

China-linked APT group FamousSparrow has been running an active espionage campaign against Latin American government organizations since at least August 2025. The campaign uses a new modular C++ backdoor called SparroWocky, which features encrypted command-and-control communication, modular plugin loading, and persistence through DLL sideloading.

Recorded Future’s disclosure confirms that FamousSparrow has expanded its geographic targeting beyond the Southeast Asian and European government targets it was previously known for. The modular architecture of SparroWocky suggests a mature development lifecycle - the backdoor is designed for long-term, low-noise access to sensitive networks. MITRE ATT&CK techniques include T1574.002 (DLL Side-Loading), T1071.001 (Application Layer Protocol: Web Protocols), and T1027 (Obfuscated Files or Information).

What defenders should do: Organizations with Latin American government exposure should review network telemetry for anomalous encrypted outbound connections, particularly from systems running applications known to be vulnerable to DLL sideloading. Feed indicators from the Recorded Future report into threat intelligence platforms and SIEM correlation rules.

Defender Action Items

  • Cisco ISE: Patch CVE-2026-76460 immediately. Restrict ISE management API access to dedicated management VLANs. Audit ISE policy changes and admin account creation since the vulnerability window opened.
  • Check Point MGMT: Apply LivePatch. Verify management server is on isolated out-of-band network. Review management server access logs for unexpected source IPs.
  • Brevo / Supply-chain: Audit third-party script injections on web properties. Implement CSP headers and SRI. Rotate API keys with CDN/DNS access. Enforce MFA on all SaaS platform credentials.
  • Unbound DNS: Update Unbound resolvers to patched version - CVE-2026-81642 is a heap overflow in the DNSSEC validator triggered by malicious DNS zones.
  • Docker Desktop (macOS): Update to patched version - CVE-2026-77179 is a sandbox escape that allows guest-to-host file access.
  • Orkes Conductor: Patch or isolate - CVE-2026-58138 is an actively exploited unauthenticated RCE in the workflow orchestration platform.

Detection Queries

Monitor for unauthorized ISE API access and admin account creation - the primary indicators of CVE-2026-76460 exploitation:

index=cisco_ise sourcetype="cisco:ise:audit"
  (event_type="AdminLogin" OR event_type="PolicyChange" OR event_type="AdminAccountCreated")
| eval suspicious=if(
    (event_type="AdminLogin" AND src_ip NOT IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"))
    OR event_type="AdminAccountCreated",
    "yes", "no")
| where suspicious="yes"
| stats count by _time, src_ip, event_type, admin_user, description
| sort -_time

This query flags ISE admin logins from non-RFC1918 source IPs and any new admin account creation events. Tune the source IP allowlist to match your management network ranges. Any hit during the CVE-2026-76460 exposure window warrants immediate investigation - treat the ISE deployment as potentially compromised if unexpected admin activity is found.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.