Week in review: Cisco patches exploited email gateway 0-day, Revolut breach
Weekly roundup: Cisco patches actively exploited email gateway zero-day CVE-2026-76461, Revolut discloses breach via government-agency impersonation, plus Acronis, Parallels, Cisco ISE flaws.
Help Net Security's week-in-review digest aggregates the past week's top security and AI stories. Headliners are Cisco patching CVE-2026-76461, an actively exploited SQL injection zero-day in Secure Email Gateway, and Revolut confirming that someone impersonating a government agency obtained sensitive customer records via the agency's email domain. The roundup also covers an exploited Acronis backup plugin privilege escalation (CVE-2026-87886), a Parallels Desktop local root flaw dubbed ParaShells (CVE-2026-90894), a targeted unauthenticated Cisco ISE authentication bypass (CVE-2026-76460), new CISA cyber-decoy guidance, and EU calls to slow frontier AI development.
- Cisco fixed CVE-2026-76461, an actively exploited SQL injection zero-day in Secure Email Gateway, and shared IOCs.
- Revolut confirmed an attacker impersonating a government agency obtained sensitive customer records via the agency's domain.
- Acronis warned that CVE-2026-87886, a Linux privilege escalation bug in cPanel/WHM/Plesk backup extensions, is exploited in targeted attacks.
- Parallels Desktop flaw CVE-2026-90894, dubbed ParaShells, lets any local Mac user gain root privileges.
- Cisco also confirmed CVE-2026-76460, an unauthenticated authentication bypass in Identity Services Engine's API being targeted.
- Tags
- authentication-bypassciscodata-breachprivilege-escalationrevolutsql-injectionweekly-roundupzero-day
- Victims
- Revolut
- Organizations
- European Commission
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 40% | KEVPoC ×3 | KEV |
| CVE-2026-87886 | Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-90894 | Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection | 7.8 | — |
From the original article
13 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What we know about the Revolut data breach so far Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank confirmed the incident on Saturday, September 12.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.