ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “ise”

16 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 42Exploit / PoC 20Advisory 17Malware 9Ransomware 5Industry 4Data breach 3Phishing & fraud 2AI tools & infra 2Threat actor 2AI research 1Policy & legal 1
SeverityAllcritical 51high 20medium 23low 10info 4

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access

Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.

Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 (September 16, 2026) describes CVE-2026-76460, insufficient authentication controls (CWE-648) on an exposed API endpoint in Cisco ISE and ISE-PIC, rated CVSS 10.0. Successful exploitation lets an unauthenticated remote attacker bypass management interface authentication and potentially obtain command-and-control with root privileges, enabling log tampering and persistence. Software updates are available with no workarounds; Cisco urges prioritized patching, log review for suspicious usernames, and reimaging of suspect nodes.

GBHackersupdated · 50m agofirst · 1h agoVulnerability in the wild 19 sourcesCVE-2026-76460

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.

CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.

BleepingComputer · 3h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-76423CVE-2026-20176+4 CVEs1· 1 read

When LLM judges agree, should we believe them?

Amazon ICML paper uses Ising models to correct correlated LLM-judge votes, beating accuracy-weighted panels by 9-14%.

Amazon Science describes an ICML paper, "Dependence-aware label aggregation for LLM-as-a-judge via Ising models," addressing how correlated judge outputs inflate majority-vote confidence. The unsupervised method models pairwise dependence between judges, learning both reliability and similarity without human reference labels. Tested on relevance, toxicity, and summarization tasks with 10 judge models at temperature zero, it outperformed accuracy-weighted voting by 9% to 14%.

Hacker News · AI · 2d agoAI researchHN 41↑ · 23 comments

Cisco Advance Notification for Publication of September 16, 2026, Security Advisories

Cisco will publish security advisories with fixed software on September 16, 2026, covering BroadWorks, ISE, Nexus Dashboard, ASA, FMC, FTD and ThousandEyes.

Cisco PSIRT announced advance notification for security advisories to be published on September 16, 2026, along with fixed software releases. Affected products include BroadWorks CommPilot Application Software, Identity Services Engine (ISE), Nexus Dashboard, Secure Firewall ASA, Secure Firewall Management Center (FMC), Secure Firewall Threat Defense (FTD), and ThousandEyes Virtual Appliance. ISE, Nexus Dashboard and the Secure Firewall products receive security hardening releases, and the ASA, FMC and FTD advisories will be included in the same combined release.

Cisco Security Advisories · 7d agoAdvisory

Applied Systems Engineering ASE2000 V2 Communications Test Set

CISA warns ASE2000 V2 test sets allow arbitrary file read/write, outbound request abuse, and TLS peer impersonation; version 2.38 fixes both vulnerabilities.

CISA published ICS advisory ICSA-26-239-04 for Applied Systems Engineering (Kalkitech) ASE2000 V2 Communications Test Set versions 2.25 through 2.37. Exploitation could allow reading or writing arbitrary local files, forcing outbound network requests, or intercepting the TLS connection to impersonate the trusted peer and read or modify protected communications. Vendor ASE/Kalkitech provides upgraded version 2.38, which also updates the bundled log4net library, fixing both vulnerabilities; customers are advised to upgrade.

CISA Advisories · 20d agoAdvisory

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

A remote code execution proof of concept for Joomla Content Editor (JCE) 2.9.15 was published on Exploit-DB.

Exploit-DB added a webapps proof-of-concept for remote code execution affecting the Joomla Content Editor (JCE) component version 2.9.15. JCE is a widely deployed editor extension used on Joomla websites. The entry provides no CVE id and no evidence of in-the-wild exploitation.

Exploit-DB · Aug 17, 2026Exploit / PoC1

Secure Access Service Edge (SASE) Archives

Palo Alto Unit 42 archive page describing Secure Access Service Edge (SASE), a cloud architecture unifying SD-WAN with SWG, CASB, FWaaS and ZTNA services.

Category archive page defining SASE as a cloud-native architecture that converges SD-WAN with security functions such as SWG, CASB, FWaaS and ZTNA into one cloud service. It frames SASE as a shift from separate networking and security disciplines to unified, cloud-delivered security and connectivity. The page contains no news, incident, vulnerability or research findings.

Palo Alto Unit 42 · Aug 17, 2026Industry

[webapps] Langflow 1.10.0 - RCE

A public proof-of-concept demonstrates remote code execution in Langflow 1.10.0, the open-source AI workflow builder.

Exploit-DB lists a remote code execution proof of concept targeting Langflow version 1.10.0. Langflow is a widely used open-source tool for building AI agent and LLM workflows. The listing does not include a CVE id or evidence of in-the-wild exploitation, but RCE in AI development tooling is relevant to teams running it in production.

Exploit-DB · 15d agoExploit / PoC1

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

Wordfence's AI-assisted Argus found a six-step critical RCE chain in the Avada WordPress theme, which has more than one million sales.

Wordfence reports that its Argus research uncovered a complex six-step exploit chain yielding critical remote code execution in the Avada WordPress theme, one of the best-selling themes with over one million sales. The company also notes AI-assisted submissions to its bug bounty program grew from 16% to roughly two-thirds of all reports in recent months. Sites running Avada should apply the patched release.

Wordfence · 22d agoVulnerability

SAP Patches Critical Extended Passport Processing Vulnerability

SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.

CVE-2026-44756 is a CVSS 10.0 memory corruption flaw in Extended Passport (EPP) deserialization, triggered when a user session opens across web, SAP GUI, and RFC vectors. Exploitation yields command execution as the SAP OS account, database credential and password hash recovery, session reading, and data or binary modification; affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, and BW/4HANA. Three other criticals were patched: CVE-2026-58240 (S4GET, missing authentication affecting all S/4HANA 2025 and earlier releases), CVE-2026-76969 (CAP credential disclosure), and CVE-2026-66768 (NetWeaver access control). Onapsis and SAP report no indicators of in-the-wild exploitation.

SecurityWeek · 8d agoVulnerability 2 sourcesCVE-2026-44756CVE-2026-58240CVE-2026-76969+1 CVEs

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commits · 8d agoTools

Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification

NIST Bugs Framework evaluation shows it is more structured and automation-friendly than CWE for automated vulnerability classification, with gaps in attribute guidance.

The paper evaluates NIST SP 800-231's Bugs Framework (BF) against CWE as a target for automated CVE classification using a systematically screened corpus of CVE-to-CWE research. An inter-rater study with 2 subject-matter experts mapping 13 CVEs showed strong agreement on BF's cause and operation axes but only fair agreement on the attribute axis. Automated classification was tested across two LLM deployments under different budgets, and findings support BF as more structured and automation-friendly than CWE, though gaps include under-specified attribute guidance and missing fix commits for closed-source software.

arXiv cs.CR · 2d agoResearch1

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

Cisco patched an XXE flaw in BroadWorks' OCI XML parser letting unauthenticated remote attackers read sensitive files from the filesystem.

Cisco BroadWorks permits external entity resolution by default in its Open Client Interface XML parser, enabling out-of-band blind XXE injection. An unauthenticated remote attacker can send crafted XML to the OCI-P provisioning service and read sensitive configuration files with BroadWorks user privileges. Cisco has released software updates and no workarounds are available.

Cisco Security Advisories · 28d agoAdvisory

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

Wordfence · 2d agoVulnerability

Webinar: Learn How to Answer “Are We Exposed?” Faster After a New CVE

Tines will host a September 2026 webinar showing security teams how to combine SBOM, endpoint, cloud, and vulnerability data into one exposure assessment workflow.

The Hacker News published a contributed webinar announcement from Tines titled "Outpacing AI-Era Attacks Starts With Faster Time to Answer." Tines Co-founder Thomas Kinsella and Senior Security Operations Engineer Andrew Katz will demonstrate connecting SBOM data, endpoint application data, cloud inventory, and vulnerability feeds into a single interactive exposure view. The session also covers pairing AI-assisted analysis with deterministic, reviewed automation to reduce time from CVE disclosure to exposure determination.

The Hacker News · 7d agoIndustry

Prisma SASE Archives

Palo Alto Unit 42 archive page describing Prisma SASE, which converges network security, SD-WAN and Autonomous Digital Experience Management in one service.

Vendor category page describing Prisma SASE as Palo Alto Networks' Secure Access Service Edge offering, combining network security, SD-WAN and Autonomous Digital Experience Management in a single service. The page contains no news, incident, vulnerability or research content.

Palo Alto Unit 42 · Aug 17, 2026Industry