Cyber Roundup: Week of September 14

1. Cisco: ISE CVE-2026-76460 CVSS 10.0 authentication bypass under active exploitation

El titular: On September 16, 2026, Cisco released emergency patches for CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). CISA added the vulnerability to the Known Exploited Vulnerabilities catalog the same day with a federal patching deadline of September 19. Cisco PSIRT confirmed active exploitation and identified the flaw while resolving a customer support case. An unauthenticated remote attacker sends a crafted request to an API endpoint that fails to enforce authentication, bypasses the web management interface entirely, and reaches the appliance.

Lo que realmente estamos viendo: ISE is the network access control platform that decides who and what reaches the corporate network. A CVSS 10.0 unauthenticated bypass against the platform that controls access to everything else is a category of incident that compromises the segmentation logic underneath every other control.

The flaw sits in the Kong API Gateway that sits in front of every ISE application server, which means a bypass at that layer reaches every downstream service. There are no workarounds. Infrastructure access control lists that restrict traffic to the ISE appliance prevent remote exploitation but require operational change. To resolve the vulnerability, customers must upgrade to ISE 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12.

Cisco’s September batch also includes a second CVSS 10.0 REST API authentication bypass in ISE, CVE-2026-76423, disclosed in the same coordinated release. Two maximum-severity authentication bypasses in one product family in one month is a pattern worth naming, not a coincidence.

La pregunta del CISO: If your network access control platform were compromised tomorrow, how much of your segmentation strategy would still be enforceable, or would the attacker inherit the same trust the platform grants every authenticated user?

2. AIR Security: Plugin4Shell zero-click RCE hits four major AI coding agents

El titular: On September 17, 2026, researchers at AIR Security publicly disclosed Plugin4Shell, a zero-click remote code execution vulnerability affecting Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. The flaw is a SHA-pinning bypass: affected agents fetch a pinned commit hash for a plugin but do not verify that the checked-out working tree corresponds to the pinned SHA. An attacker who controls a plugin repository can create a branch whose name matches a 40-character commit hash, and Git resolves the branch name in place of the intended commit. The attack is zero-click because Claude Code and Codex update installed plugins automatically in the background.

Lo que realmente estamos viendo: Two of the four vendors have patched. Two have not. Microsoft has not shipped a Copilot fix. Google has deprecated Gemini CLI without patching it and recommends users migrate to Antigravity. Every existing Gemini CLI install stays exposed indefinitely.

AIR Security described Plugin4Shell as the first supply chain vulnerability of the AI agent ecosystem. The characterization matters because coding agents inherit the permissions of the developer running them. That reach typically includes local source code, cloud credentials, SSH keys, internal repositories, production systems, and secrets. A malicious plugin update that passes the trust check produces the same access the developer has.

Anthropic patched in Claude Code 2.1.179. OpenAI patched in Codex 0.146.0. Both fixes require the agent version to be updated, not just the plugin. The researchers privately notified all four vendors in June 2026, giving them approximately three months before public disclosure. Roughly 90 percent of Fortune 500 companies use Copilot, and it remains one of the unpatched agents as of last week.

La pregunta del CISO: If your engineering teams use AI coding agents from Microsoft or Google, do you have an inventory of which agents are running, which plugins are installed, and which have been left running despite the vendor’s decision not to patch?

3. SolarWinds: ARM CVE-2026-28326 unauthenticated RCE traces to a hard-coded static key

El titular: On September 17, 2026, SolarWinds released an advisory for CVE-2026-28326, a CVSS 8.8 unauthenticated remote code execution vulnerability in Access Rights Manager (ARM). The advisory attributes the flaw to a hard-coded static key inside the product. All versions of ARM 2026.2 and prior are affected. The fix ships in ARM 2026.2.1. Armadin security researcher Kai Huang is credited with the discovery. SolarWinds has not reported evidence of exploitation in the wild.

Lo que realmente estamos viendo: Access Rights Manager is the SolarWinds product enterprises use to audit and manage user permissions across Active Directory, file shares, SharePoint, and Exchange. A hard-coded static key means the authentication step that was supposed to gatekeep the platform never actually varied per deployment. Every ARM installation shares the same secret.

Hard-coded credentials and keys in enterprise software remain a recurring class of finding because the shortcut is invisible from the outside until a researcher decompiles the binary. The operational impact on ARM is unusually broad. An attacker who reaches an internet-exposed ARM instance and knows the static key can execute arbitrary code on the server that governs permissions across the rest of the environment.

SolarWinds is the third named enterprise access-management or management-plane vendor to disclose a critical vulnerability in the past two weeks, alongside the Cisco ISE bug in this same roundup and the N-able N-central RCE from the prior week. Attackers work through categories, not individual products.

La pregunta del CISO: If your organization runs SolarWinds ARM, has the patch to 2026.2.1 landed, and has your team confirmed that ARM’s management interface is not exposed to the public internet regardless of patch status?

4. Orkes Conductor: CVE-2026-58138 pre-auth RCE draws Fortinet outbreak alert

El titular: On September 18, 2026, Fortinet issued an outbreak alert for CVE-2026-58138, a CVSS 9.8 unauthenticated remote code execution flaw in Orkes Conductor, the open-source workflow orchestration platform used by more than 3,000 enterprises including LinkedIn, Twilio, and Quest Diagnostics. Attackers submit crafted workflow definitions containing JavaScript or Python expressions to the Conductor workflow API. The expressions execute inside a GraalVM context configured with unrestricted host access, letting an attacker escape the intended scripting environment and run arbitrary OS commands with the privileges of the Conductor process.

Lo que realmente estamos viendo: Fortinet blocked roughly 1,300 exploit attempts in a 24-hour window between September 8 and 9. Nearly 7,000 attempts were blocked between September 2 and 9. The exploitation activity originates primarily from Germany, Hong Kong, Indonesia, the UAE, and India.

Conductor is what Empirical Security called “the 9.8 nobody knows they are running.” The platform sits at the center of enterprise service orchestration, firing tasks that move data between systems. It is rarely on the security organization’s asset inventory because engineering teams deploy it directly. Because Conductor is open source, many installs never appear on any centralized inventory at all. Public exploit code exists on Exploit-DB. The patch (Conductor 3.30.2) shipped in June 2026, giving vulnerable organizations three months to apply it.

The Conductor process often runs as root inside its default container image, which means a successful exploit lands at the highest possible privilege on the host. When Conductor is federated with service credentials to reach other enterprise systems, that root-level compromise inherits every credential the workflow engine holds.

La pregunta del CISO: Do you know which teams in your organization run Orkes Conductor, and if the answer is no, what other engineering-deployed platforms sit outside the security asset inventory that would carry the same blast radius under a similar vulnerability?

5. BambooToken: MQTT-based C2 controls Windows and Linux across Asia and South America

El titular: On September 15, 2026, cybersecurity researchers disclosed BambooToken via The Hacker News, an emerging multi-platform malware family that uses the Message Queueing Telemetry Transport (MQTT) protocol as its command and control channel to operate Windows and Linux systems. The family has been active since at least February 2023 and is currently deployed in campaigns targeting organizations across Asia and South America.

Lo que realmente estamos viendo: MQTT is a lightweight publish and subscribe protocol designed for constrained IoT deployments, not enterprise environments. Threat actors are using it as C2 precisely because it does not match the traffic signatures most enterprise detection systems are tuned for. Any organization operating an IoT footprint runs MQTT brokers that look like normal telemetry sources to a monitoring stack.

BambooToken’s multi-platform nature is what makes the campaign operationally different from most malware families of comparable maturity. A single command channel controls both Windows workstations and Linux servers, which lets an operator run coordinated activity across mixed environments without switching tooling. Detection engineering built around Windows-first assumptions misses the Linux half of the same campaign, and vice versa.

The February 2023 start date matters for defenders. A campaign that has run for three and a half years before disclosure suggests either narrow targeting that avoided detection or effective enough tradecraft to hide inside enterprise IoT telemetry. Both possibilities point to the same defensive conclusion. IoT and OT protocols operating on the same network segments as user endpoints deserve monitoring that assumes they can be adversarial, not just noisy.

La pregunta del CISO: Your endpoint detection catches process anomalies on Windows and Linux servers. Does it also alert when an IoT protocol like MQTT starts carrying instructions that look nothing like telemetry, or is that traffic invisible until an operator makes a mistake?

El patrón en las cinco historias

Every story this week turned on a verification step that was structurally present and functionally absent. The authentication check was in the codebase. The pinned SHA was in the plugin manifest. The static key was called a key. In each case the check existed and did not enforce anything.

CybelAngel surfaces the exposed management planes and leaked credentials that turn a verification gap into someone else’s incident.