21st September – Threat Intelligence Report
Check Point weekly roundup covers Japan Digital Agency and Gyazo breaches, actively exploited Cisco ISE flaw, and multiple new APT campaigns.
The report covers major breaches including Japan's Digital Agency (246,000 records via VPN appliance flaw) and Gyazo image service (23M+ user records and 490M image metadata records). Cisco disclosed active exploitation of CVE-2026-76460 (CVSS 10.0) in ISE, while Check Point patched CVE-2026-91843 (CVSS 9.8) and Oracle's September CPU addressed 800+ vulnerabilities. Threat intelligence includes WaterPlum/Contagious Interview (30,000 devices infected, 7,000+ crypto wallets drained), FamousSparrow's new SparroWocky backdoor, the HEAVYGRAM Iranian surveillance backdoor, and the GhostCode device-code phishing kit.
- Cisco CVE-2026-76460 (CVSS 10.0) actively exploited in ISE management interface
- Gyazo breach exposed 23M+ user records via image upload server vulnerability
- WaterPlum campaign infected 30,000 devices across 100+ countries since December 2025
- Oracle September CPU patches 800+ vulnerabilities, over 100 rated critical
- BragJack attack let malicious extensions hijack AI assistants in several browsers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 40% | KEVPoC ×3 | KEV |
| CVE-2026-77692 | Unauthenticated DoS in ISC BIND 9 via crafted SIG(0) DNS-over-HTTPS requests | 7.5 | — | ||
| CVE-2026-91843 | Unauthenticated stack overflow gives root RCE in Check Point login process | 9.8 | <1% | PoC |
From the original article
4 min read at research.checkpoint.com
For the latest discoveries in cyber research for the week of 21st Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance. Approximately 246,000 records were exposed, […]
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.