Search: “authentication”

11 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Advisory 26 Vulnerability 18 Exploit / PoC 10 AI safety & security 6 Phishing & fraud 5 Data breach 4 Malware 3 Research 3 Threat actor 3 Industry 1

SeverityAll critical 5 high 31 medium 26 low 7 info 10

Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

Cisco patched an authenticated command injection in ThousandEyes Virtual Appliance allowing arbitrary OS command execution with root privileges.

Improper validation of user-supplied input in the web-based management interface of Cisco ThousandEyes Virtual Appliance enables command injection. An authenticated remote attacker with valid administrative credentials can save configuration details containing malicious values to execute arbitrary operating system commands with root privileges. Cisco has released software updates that address the vulnerability.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 15h agoAdvisory

Cisco Identity Services Engine Hardening Release: September 2026

Cisco ISE hardening release fixes multiple internally discovered vulnerabilities, including an authentication bypass known to be actively exploited.

Cisco released September 2026 hardening updates for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) following a comprehensive internal security review that uncovered multiple vulnerabilities. One of the flaws, an ISE authentication bypass, is known to be actively exploited. Cisco grouped the issues by underlying vulnerability to help customers prioritize patching and streamline disclosure.

Cisco Security Advisoriesupdated 06:19 UTC · 40m agofirst Sep 16, 16:00 UTC · 15h agoAdvisory in the wild 16 sources

Cisco Secure Firewall Management Center Software sftunnel Root Arbitrary Code Execution Vulnerability

Cisco patched an sftunnel flaw in Secure Firewall Management Center letting an authenticated remote attacker execute arbitrary commands as root.

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center allows an authenticated remote attacker to execute commands as root. The flaw stems from incorrect permissions allowing a registered sftunnel peer to write an arbitrary file anywhere on the device, exploitable via connection hijacking or crafted sftunnel commands. Cisco has released software updates.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 15h agoAdvisory 6 sources

Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

Cisco patched a BroadWorks CommPilot authorization bypass letting low-privileged authenticated users alter device configurations via crafted HTTP requests.

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software is caused by missing authorization checks. An authenticated remote attacker with low privileges can send crafted HTTP requests to alter configurations on select pages. Cisco has released software updates and no workarounds are available.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 15h agoAdvisory

Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families

Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.

Oracle's September 2026 Critical Security Patch Update ships 673 patches covering 672 unique CVEs, with more than 130 additional CVEs resolved through bundled fixes, pushing the effective total past 800. Over 100 flaws are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 fixes, Fusion Middleware 153 (78 unauthenticated and network-exploitable), and Hyperion 102. No in-the-wild exploitation of these specific flaws is reported, but Oracle cites CISA's earlier 72-hour remediation order for actively exploited CVE-2026-21962 (CVSS 10.0).

Cyber Security Newsupdated Sep 16, 19:29 UTC · 11h agofirst Sep 16, 13:03 UTC · 17h agoAdvisory 3 sources CVE-2026-219621

Jenkins Security Advisory 2026-09-16

Jenkins released a security advisory patching vulnerabilities across 13 plugins, including GitLab, Bitbucket, Gradle, Keycloak Authentication, and Script Security.

The Jenkins security advisory dated September 16, 2026 addresses vulnerabilities in 13 plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script Security, and Warnings. Jenkins users should update the affected plugins to the patched versions listed in the advisory.

Jenkins Security Advisoriesupdated Sep 16, 15:09 UTC · 15h agofirst Sep 16, 12:00 UTC · 19h agoAdvisory 2 sources

AI agent authorization risks remain a gap in new NIST-CISA token security guidance

NIST and CISA release IR 8587 guidance on securing signed tokens, but AI agent authorization and delegation risks remain out of scope.

NIST, with CISA support, published 'Protecting Tokens and Assertions from Forgery, Theft, and Misuse' (NIST IR 8587), recommending continuous monitoring and tighter token lifecycle controls for SSO and API access. The guidance does not yet fully address AI agent identity, delegation chains, or prompt injection steering agents with valid tokens, and NIST says new or expanded standards are needed. Experts recommend treating AI agents as low-trust non-human identities, maintaining agent inventories, expiring credentials after task completion, and requiring human approval for high-risk actions. The report references shared-signal mechanisms like CAEP and RISC, and follows a May incident where a CISA contractor GitHub repository exposed AWS and GitHub tokens.

CSO OnlineSep 16, 15:42 UTC · 15h agoAdvisory

Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

A TLS 1.3 buffer management flaw in Cisco Secure Firewall Threat Defense lets remote attackers crash the LINA process and reload devices.

A vulnerability in the TLS 1.3 implementation of Cisco Secure Firewall Threat Defense (FTD) software allows an unauthenticated remote attacker to cause a denial of service via crafted TLS 1.3 packets sent to a TLS 1.3-enabled listening socket. Improper buffer management causes the LINA process to crash, forcing a device reload that can occur before or after connection authentication. Cisco has released software updates to address the flaw.

Cisco Security AdvisoriesSep 16, 16:00 UTC · 15h agoAdvisory 9 sources

Oracle Critical Security Patch Update, September 2026 Review

Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.

Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.

Qualys ThreatPROTECTSep 16, 14:15 UTC · 16h agoAdvisory CVE-2026-83154 CVE-2026-83196 CVE-2026-83197+10 CVEs

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.

CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.

Infosecurity MagazineSep 16, 14:00 UTC · 17h agoAdvisory

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net SecuritySep 16, 07:40 UTC · 23h agoAdvisory 2 sources