Cyber Threat Brief — September 17 2026
1. Cisco ISE Unauth API Auth Bypass → Root — CVE-2026-76460
TL;DR: Cisco advisory 2026-09-16 + CISA KEV same day: unauthenticated CVE-2026-76460 (CVSS 10.0) in Cisco ISE / ISE-PIC — insufficient auth on an API endpoint lets a remote attacker bypass the web management interface regardless of configuration; successful exploit can yield root command execution and IoC wiping. No workarounds. Patch 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4. Federal KEV due 2026-09-19; forensic triage Yes. Mitigate with iACLs until patched.
What’s New:
- Cisco PSIRT aware of active exploitation (found via TAC case); actor/campaign undisclosed; CISA added to KEV 2026-09-16 (catalogVersion 2026.09.16)
- Cisco IoC: on every node run
show logging application ise-kong/access.log | include dummyuser— any hit may indicate malicious activity; support-bundle path./ise/logs/apigateway/access.log - Root post-exploit can erase local evidence — cross-check external firewall/network logs for unexpected uploads from ISE to external IPs / downloads from malicious IPs
- Same-day Cisco hardening drop includes many other critical ISE/Firewall CVEs (no ITW claim) — inventory/patch separately; do not conflate with CVE-2026-76460
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Cisco ISE / ISE-PIC not on 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4 — CVE-2026-76460 | Vulnerable NAC appliance | T1190 / T1078 | CMDB / ISE CLI show version / Cisco software inventory | Upgrade every node to fixed patch train; ISE 3.0 EOS — migrate; until patched restrict management with iACLs (trusted admin nets only) |
CLI hit: show logging application ise-kong/access.log | include dummyuser (or decrypted support-bundle ./ise/logs/apigateway/access.log) | Exploit / suspicious username IoC | T1190 / T1078 | ISE CLI / support bundle (each deployment node) | Any match → treat as likely compromise; re-image affected nodes + restore config backup; preserve off-box logs first |
| Unexpected egress from ISE management IP to external destination (upload/download) | Post-exploit C2 / staging | T1041 / T1105 | Perimeter firewall / NetFlow / proxy (outside the appliance) | Hunt ISE-sourced egress to non-admin peers; block unknown destinations; correlate with access.log window |
| CISA KEV CVE-2026-76460 due 2026-09-19 (BOD forensic triage Yes) | Compliance / patch SLA | N/A | Vuln management / KEV tracker | Patch by due date; complete forensic triage before declaring clean |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-76460 / Cisco ISE / ise-kong / dummyuser / apigateway access.log | Nearest auth-bypass analytics (Fortinet Appliance Auth Bypass, F5 TMUI Authentication Bypass) match product-specific URI/methods — would not catch ISE ise-kong/access.log suspicious usernames |
| Elastic | None — verified search for ISE / ise-kong / dummyuser / CVE-2026-76460 | No ISE management API / Kong access-log rule; Fortigate/cPanel CRLF rules are wrong product |
| Sigma | None — verified search for Cisco ISE / dummyuser / ise-kong | No emerging-threat rule for this API auth-bypass path |
Hunt hint: (1) Inventory all ISE/ISE-PIC nodes; force fixed patches above. (2) On every node: show logging application ise-kong/access.log | include dummyuser; pull support bundle with debug logs if needed. (3) Firewall: list connections sourced from ISE mgmt IPs to unexpected externals. (4) On hit: re-image + restore config; rotate admin creds/certs; assume root may have wiped local logs.
Sources: Cisco SA cisco-sa-ISE-ABP-VNSW7Tn5, The Hacker News, SecurityWeek, CISA KEV, CVE-2026-76460
2. Acronis cPanel/Plesk Backup Plugin LPE — CVE-2026-87886
TL;DR: Acronis SEC-10986 + THN/BC/Help Net (2026-09-15/16): Linux local privilege escalation CVE-2026-87886 (CVSS 7.8, CWE-276 incorrect default permissions) in Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Plesk extension (builds < 1.8.11.638). ITW in limited targeted attacks against cPanel/WHM (no Plesk exploitation reported). Fix: cPanel/WHM 1.9.3 HF3 (build 1.9.3.1021); Plesk 1.8.11 (build 1.8.11.638). CISA KEV added 2026-09-16; due 2026-09-19; forensic triage Yes. Exact world-writable paths not disclosed — treat host as potentially rooted after foothold.
What’s New:
- Vendor confirms ITW against cPanel/WHM plugin; Acronis told BC assessment based on a single “potentially affected” customer report — still KEV
- No public file-path IoCs / PoC; do not invent paths — hunt via version inventory + post-foothold Linux LPE behaviors on hosting panels
- Shared-hosting blast radius: low-priv tenant → backup-plugin privileges → host impact
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Acronis Backup plugin for cPanel & WHM build < 1.9.3.1021 — CVE-2026-87886 | Vulnerable hosting backup plugin | T1068 | cPanel/WHM plugin manager / host package inventory | Upgrade to 1.9.3 HF3 (build ≥1.9.3.1021) immediately; assume compromise if exposed during exploit window |
| Acronis Backup extension for Plesk build < 1.8.11.638 — CVE-2026-87886 | Vulnerable hosting backup extension | T1068 | Plesk extension catalog / host inventory | Upgrade to 1.8.11 (build ≥1.8.11.638) even though ITW currently reported on cPanel only |
| Low-priv local user → sudden root-equivalent activity on cPanel/WHM host with vulnerable Acronis plugin (new root cron/sudoers/SSH key) | Post-LPE persistence | T1068 / T1548 | Linux auditd / EDR / FIM (/etc/sudoers*, /etc/cron*, ~/.ssh/authorized_keys, new SUID) | On unpatched hosts: hunt privilege jumps; rotate creds; review backup jobs + panel admin accounts; re-image if rooted |
| CISA KEV CVE-2026-87886 due 2026-09-19 (forensic triage Yes) | Compliance / patch SLA | N/A | Vuln management / KEV tracker | Patch by due date; complete BOD forensic triage on internet-facing / multi-tenant hosts |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-87886 / Acronis / cPanel Backup plugin insecure permissions | Linux Setuid Using Chmod Utility / Linux Auditd File Permission Modification Via Chmod catch chmod abuse — not vendor incorrect-default permissions already present; no Acronis/cPanel plugin analytic |
| Elastic | None — verified search for Acronis Backup / CVE-2026-87886 | Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) is a different cPanel CVE (HTTP CRLF session forge) — would not catch this LPE |
| Sigma | None — verified search for Acronis / CVE-2026-87886 / cPanel backup plugin perms | No rule naming this plugin or insecure-default backup paths |
Hunt hint: (1) Inventory cPanel/WHM + Plesk hosts with Acronis Backup add-ons; force builds above. (2) Prefer rebuild/credential rotation on any multi-tenant host that ran vulnerable builds during the ITW window. (3) EDR/auditd: unexpected root child of panel/backup UIDs; new sudoers/cron/SSH keys. (4) Do not wait for disclosed path names — patch is the control.
Sources: Acronis SEC-10986, The Hacker News, BleepingComputer, Help Net Security, CISA KEV, CVE-2026-87886
Status Updates
- CVE-2026-76461 (Cisco ESA AsyncOS): CISA KEV due TODAY 2026-09-17 — patch AsyncOS 15.5.5-014 / 16.0.4-302 / 16.5.0-780 (prefer 16.5.0-780); on each cluster member
grep -i "COPY.*TO PROGRAM"on mail_logs; enable Snort 67109/67110; BOD forensic triage Yes; cross-check egress from ESA IPs. Sep 15 - CVE-2026-58704 (Pixel Cellular Modem): Now on CISA KEV (added 2026-09-16, due 2026-09-19, forensic triage Yes) — escalate managed Pixels to patch level 2026-09-05+ via MDM/Intune. Sep 16
- CVE-2026-27540 (WWLC) / CVE-2026-90894 (Parallels ParaShells) / CVE-2026-39987 (Marimo): No material change — keep prior hunts (
wwlc_file_upload_handler,prl_disp_service→tar --use-compress-program,/terminal/ws+GetSecretValue). Sep 16 - CVE-2026-85706 (GitLab) / CVE-2026-84869 (ScreenConnect) / PaperCut CVE-2026-81578/82078: KEV due was 2026-09-14 — confirm remediation. Sep 12 · Sep 14
- MikroTrick CVE-2026-67277/86060: KEV due was 2026-09-13 — confirm RouterOS fixed trains. Sep 6 · Sep 13
- Check Point CVE-2026-85102/85103: Dutch NCSC still imminent — LivePatch Take 24 / Jumbo trains. Sep 11
- CVE-2026-42016/42018 (JFrog): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Chrome CVE-2026-85046 (due Sep 18) / Windows CVE-2026-81963+85880 (due Sep 22) / Chrome CVE-2026-87491 (due Sep 23) + GRIMWEDGE: Keep prior C2/file hunts (
cloud.shinewrist.net,ocr.opusaccel.top,206.166.251.164,%TEMP%\msgbox.exe, task Windows Scheduled System). Sep 11 · Sep 9 · Sep 15 - CVE-2026-51990 / GRAYRABBIT + Storm-3121 Passkey + SGLang CVE-2026-86793: No material change — keep prior hunts. Sep 14 · Sep 13