CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities with confirmed exploitation in the wild to its Known Exploited Vulnerabilities (KEV) catalog. The additions were announced on September 16, 2026, with a mandatory remediation deadline of September 19 for all affected products.
Two of the flaws reside in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Tracked as CVE-2026-76460, the vulnerability results from insufficient authentication controls on an API endpoint. Unauthenticated remote attackers can bypass the web-based management interface and gain unauthorized access to the affected appliances.
The third entry concerns Acronis Backup. The flaw, identified as CVE-2026-87886, affects the plugin for cPanel & WHM and the extension for Plesk. Default access permissions are configured too permissively, allowing attackers to escalate privileges on the server.
CISA is urging all federal civilian agencies to prioritize investigation of potential intrusions and to apply available mitigations or patches by the stated deadline.
Related articles
R-Vision VM 6.6 Adds Container Scanning, Web Application Audits and Mobile Scanner for Isolated Networks
R-Vision has released version 6.6 of its vulnerability management platform, expanding detection capabilities to web applications, Docker and Kubernetes container environments, and previously unreachable isolated network segments. The new web audit feature inventories resources and identifies associated vulnerabilities, although the company describes the current functionality as basic and not intended to replace dedicated DAST solutions. Container auditing now covers both Docker and Kubernetes, including runtime analysis, with findings presented directly in the host card within the central console. The most notable addition is a mobile scanner that runs on a laptop without requiring dedicated servers, allowing security specialists to audit air-gapped or remote sites and later upload results to the main R-Vision VM instance. The mobile component supports White Box, Black Box, Compliance and web-audit modes, performs full inventory, and is designed to scan up to 2000 hosts. Additional improvements include expanded inventory for ESXi, vCenter and network equipment, updated compliance checks, enhanced dashboards, automation policies and data export options, plus the ability to update agents directly from the interface.
BloodHound, smbmap and enum4linux-ng: Essential Tools for Starting Active Directory Penetration Testing
Active Directory remains the primary target in most internal penetration tests, regardless of how an attacker first gains network access. The article outlines a practical reconnaissance workflow that begins with identifying the domain name and domain controllers through port scanning for ports 88 and 389. Tools such as enum4linux-ng enable initial data collection without credentials by leveraging null sessions, while smbmap reveals readable and writable SMB shares that often contain SSH keys, certificates, and plaintext passwords. BloodHound, paired with collectors like SharpHound, maps relationships between users, groups, and computers to reveal attack paths toward Domain Admins. The piece stresses understanding Kerberos and NTLM protocols to apply techniques such as Kerberoasting, AS-REP Roasting, and pass-the-hash effectively rather than running commands blindly. It also covers quieter alternatives to noisy tools and provides a concise checklist for beginners, along with references to the Red September CyberED course on Active Directory attacks.
Apple Releases iOS 27 and iPadOS 27 with Fixes for 126 Vulnerabilities
Apple has released iOS 27 and iPadOS 27, addressing a total of 126 CVEs across multiple system components. The updates target issues in the kernel, WebKit, Bluetooth, video encoding, and media handling frameworks. Twenty kernel vulnerabilities were resolved, including problems that could allow memory corruption or privilege escalation to root level. Separate patches were also issued for older devices via iOS 26.7 and iPadOS 26.7. Notable fixes include CVE-2026-43689 in the kernel and CVE-2026-65414 affecting Bluetooth. The release was made available on September 14, 2026.
GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security released GitSpawn, detailing eight vulnerabilities across seven coding agents where opening a folder triggers arbitrary code execution via Git configuration before any user prompt. The core issue stems from the core.fsmonitor setting in .git/config, which Git executes during index updates like git status or git diff. While vendors including Anthropic patched Claude Code in version 2.1.196, the fix only blocks agent-initiated calls and leaves manual Git commands or other tools vulnerable. Additional vectors include nested bare repositories tracked under CVE-2026-45033 affecting GitHub Copilot CLI and unpatched agents such as Qwen Code and Grok Build. The researcher also released the Stroq tool to inspect repositories for dangerous settings like core.fsmonitor and postinstall scripts before opening them. The findings highlight that repository trust mechanisms from 2021 remain bypassed by modern AI coding tools.