The third week of September brings a heavy concentration of critical flaws across essential enterprise and network infrastructure nodes. Cisco triggered the largest fire drill by disclosing an actively exploited zero-day in its Identity Services Engine (ISE) with a maximum CVSS 10.0 score, alongside an unauthenticated root flaw in Secure Email Gateway triggered via crafted inbound email. Concurrently, CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog, while internet-wide scans target exposed Orkes Conductor orchestration platforms. If you manage Cisco-based enterprise networks or Linux server fleets, here is what demands immediate attention this Monday.
1. Cisco Identity Services Engine: Active Zero-Day Authentication Bypass (CVE-2026-76460)
The most dangerous incident this week is an in-the-wild zero-day flaw in Cisco Identity Services Engine (ISE). The vulnerability stems from insufficient access controls across server API endpoints. An unauthenticated remote attacker sending specially crafted HTTP requests to the API can bypass authentication entirely and gain unauthorized administrative control over the appliance.
Carrying a maximum CVSS 10.0 severity rating, the vulnerability was added to CISA KEV on an emergency basis following confirmed targeted attacks. Because ISE serves as the central policy decision point for network access control (RADIUS/TACACS+, 802.1X enforcement, TrustSec segmentation), compromise yields full lateral access across enterprise network perimeters. Cisco released software updates. No workarounds exist — immediate patching and isolating ISE management ports to dedicated out-of-band management VLANs are required.
- Identifier: CVE-2026-76460
- Base Score: CVSS 10.0 (Critical)
- Exploitation Status: Active in-the-wild exploitation confirmed (CISA KEV)
- Affected Systems: Cisco Identity Services Engine (ISE) and ISE-PIC
- Mitigation: Install Cisco ISE updates, restrict API access strictly to trusted administrative subnets
- Source: Cisco PSIRT Advisory (cisco-sa-ISE-ABP-VNSW7Tn5)
2. Cisco Secure Email Gateway: SQL Injection to Root in Mail Parser (CVE-2026-76461)
Cisco’s second critical vulnerability affects Cisco AsyncOS running on Secure Email Gateway (formerly IronPort / ESA). The flaw resides in the inbound email message parsing subcomponent. An unauthenticated remote attacker sending a specially crafted email with malicious SQL payloads can execute arbitrary database queries, escalating directly to arbitrary command execution with root privileges on the underlying operating system.
Tracked as CVE-2026-76461 (CVSS 9.8), the flaw is listed in CISA KEV. Because email gateways by design accept unauthenticated SMTP traffic from the public Internet, the attack vector is exposed to any remote sender. Cisco released fixed AsyncOS builds. With no software workarounds available, administrators should prioritize this update.
- Identifier: CVE-2026-76461
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Confirmed in-the-wild exploitation, listed in CISA KEV
- Affected Systems: Cisco Secure Email Gateway running AsyncOS
- Mitigation: Upgrade AsyncOS to patched releases
- Source: Cisco PSIRT Advisory (cisco-sa-esa-inj-2bLVGmhX)
3. Orkes Conductor: Widespread Unauthenticated RCE Exploitation (CVE-2026-58138)
Attacks targeting the Orkes Conductor workflow orchestration platform (widely deployed implementation of Netflix Conductor) escalated sharply over the past week. Vulnerability CVE-2026-58138 originates from improper sandboxing in the integrated expression evaluation engine (JavaScript and Python scripting within workflow task definitions). An unauthenticated user with access to the API port can register or trigger workflow definitions containing malicious code, obtaining remote code execution on the host system.
FortiGuard Labs issued an Outbreak Alert highlighting automated cloud-wide scanning looking for exposed Conductor endpoints. Versions 3.21.21 through 3.30.1 are vulnerable. The maintainers released a fix in version 3.30.2. If immediate upgrade is not feasible, blocking public ingress to Conductor API ports via firewall ACLs or enforcing strict reverse proxy authentication is critical.
- Identifier: CVE-2026-58138
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Automated mass scanning and active exploitation across cloud environments
- Affected Systems: Orkes Conductor versions 3.21.21 through 3.30.1
- Mitigation: Upgrade to Orkes Conductor 3.30.2+, restrict public API exposure
- Source: FortiGuard Labs Outbreak Alert
4. Linux Kernel: Three Flaws Added to CISA KEV Following Confirmed Exploitation
On September 18, CISA added three Linux kernel vulnerabilities to the KEV catalog, mandating remediation across federal systems. The first, CVE-2025-39682 (CVSS 9.8), involves improper record handling in the TLS receive queue (rx_list). The second, CVE-2025-39964 (CVSS 7.8), is a race condition in the crypto socket interface (af_alg) leading to memory corruption. The third, CVE-2026-53266 (CVSS 8.8), is an out-of-bounds write in the ebtables ARP translation module (bridge SNAT).
Ransomware operators and advanced threat actors actively leverage all three flaws as local privilege escalation (LPE) primitives following initial foothold access. Public proof-of-concept exploits surfaced in recent days. Major distributions (Debian, Ubuntu, Red Hat Enterprise Linux) released updated kernel packages through official repositories.
- Identifiers: CVE-2025-39682, CVE-2025-39964, CVE-2026-53266
- Base Scores: CVSS 9.8, 8.8, 7.8
- Exploitation Status: Confirmed in-the-wild exploitation, added to CISA KEV on September 18
- Affected Systems: Linux servers, container hosts, and embedded systems with unpatched kernels
- Mitigation: Upgrade distribution kernel packages (
linux-image/kernel) and schedule server reboots - Source: CISA KEV Advisory & Distribution Release Bulletins
5. SolarWinds Access Rights Manager: Hardcoded Cryptographic Key RCE (CVE-2026-28326)
SolarWinds released an urgent security update for Access Rights Manager (ARM), an identity and access management solution used for Active Directory permission auditing. The software contained a hardcoded cryptographic key used for internal message routing. An unauthenticated attacker on the local network or with access to the service port can leverage this key to craft malicious deserialization payloads, resulting in arbitrary code execution on the identity management host.
Tracked as CVE-2026-28326 with a CVSS 8.8 score, compromise of an ARM instance grants attackers an immediate path to Domain Admin privilege escalation. SolarWinds shipped version 2026.3.1, which eliminates the hardcoded key and enforces secure communication channels.
- Identifier: CVE-2026-28326
- Base Score: CVSS 8.8 (High)
- Exploitation Status: Official fix released, high exploitation risk in domain environments
- Affected Systems: SolarWinds Access Rights Manager prior to 2026.3.1
- Mitigation: Upgrade to SolarWinds ARM 2026.3.1
- Source: SolarWinds Security Advisory
Action Items for Today
- Patch or Isolate Cisco ISE: Audit network ACLs to confirm Cisco ISE administrative endpoints and APIs are isolated from guest networks and the public Internet, then apply updates for zero-day CVE-2026-76460.
- Upgrade Cisco Secure Email Gateway: Because SEG interfaces handle open SMTP traffic, deploy the patched AsyncOS build (CVE-2026-76461) as a high-priority maintenance task.
- Secure Orkes Conductor Instances: Upgrade the platform to release 3.30.2+ and enforce strict firewall isolation on workflow API ports.
- Deploy Updated Linux Kernels: Apply standard distribution kernel updates across production hosts and schedule rolling reboots to remediate CISA KEV entries.
- Upgrade SolarWinds ARM to 2026.3.1: If ARM is deployed for Active Directory auditing, update the server to the latest build to eliminate the hardcoded key flaw.
