ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “federation”

7 stories in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 7Data breach 1
SeverityAllcritical 4high 3medium 1low 0info 0

Google Pixel phones pwned in zero-click attacks

CISA added actively exploited zero-click Pixel modem flaw CVE-2026-58704 to its KEV catalog, giving federal agencies three days to patch.

Google disclosed CVE-2026-58704, a high-severity improper authorization flaw in Pixel phones' cellular modems that bypasses permission checks and escalates privileges with no user interaction, noting limited, targeted exploitation. CISA added it to the Known Exploited Vulnerabilities Catalog with a September 19 deadline for federal agencies. Such zero-click modem bugs are a frequent vector for commercial spyware. The Register also notes two recently KEV-listed Chromium V8 flaws, CVE-2026-85046 and CVE-2026-87491, which Proofpoint says four espionage groups chained in intrusions.

The Register · Security · 16h agoExploit / PoC in the wild 8 sourcesCVE-2026-58704CVE-2026-85046CVE-2026-874911

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Google Pixel improper authorization flaw CVE-2026-58704 to its KEV catalog, mandating federal remediation.

CISA added CVE-2026-58704, an improper authorization vulnerability in Google Pixel devices, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of KEV-listed vulnerabilities on exposed assets. CISA urges all organizations to prioritize patching KEV entries.

CISA Advisoriesupdated · 20h agofirst · 22h agoExploit / PoC in the wild 17 sourcesCVE-2026-58704

Critical ScreenConnect flaw now actively exploited in attacks

CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.

ConnectWise's ScreenConnect flaw CVE-2026-84869, an improper privilege management and missing authorization bug, lets attackers with basic privileges transfer or execute files through active remote sessions in low-complexity attacks without user interaction. It is patched in ScreenConnect 26.6.5; CISA added it to the KEV catalog and ordered US federal agencies to secure systems within three days. Shadowserver tracks over 1,000 unpatched exposed instances, mostly in North America (758) and Europe (180). This is the fourth actively exploited ScreenConnect flaw since 2024; earlier issues were abused by Kimsuky and ransomware gangs.

BleepingComputerupdated · 19h agofirst · 23h agoExploit / PoC in the wild 4 sourcesCVE-2026-84869CVE-2024-1709CVE-2025-3935+1 CVEs1

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.

CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.

BleepingComputer · 3h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-76423CVE-2026-20176+4 CVEs1· 1 read

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added actively exploited CVE-2026-76460 (Cisco Identity Services Engine) and CVE-2026-87886 (Acronis Backup) to its KEV catalog.

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-76460, an incorrect use of privileged APIs flaw in Cisco Identity Services Engine, and CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that grant total control post-exploitation, and check whether systems were compromised before patching.

CISA Advisories · 22h agoExploit / PoC in the wildCVE-2026-76460CVE-2026-87886

Hackers reveal how Flock cameras really track cars and people

Hackers tore down a Flock Safety camera, dumped its storage, recovered an encryption key, and revealed its software detects people as well as vehicles.

Hackers from a collective calling itself stegan0gram removed a Flock Safety camera from service, made a near-complete copy of its storage, and recovered an encryption key stored on the device that unlocked thousands of vehicle-detection videos, sharing the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis of about 21 days of logs shows more than a million images, roughly 28 photos per passing vehicle, and Flock-built apps that detect people, bicycles, and even bumper stickers, while plate inference happens on Flock's servers. Flock had previously downplayed early-2025 root-access research by Jon Gaines, and records from Alpharetta, Georgia were searchable by over 2,000 agencies via Flock's national network.

Ars Technica · Security · 57m agoData breach in the wild 4 sources

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

Cisco urgently patched actively exploited zero-day CVE-2026-76460 (CVSS 10.0), an ISE authentication bypass enabling root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76460 (CVSS 10.0), a zero-day authentication bypass in an API endpoint of Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), and confirmed active exploitation in the wild. Successful exploitation lets attackers bypass the web-based management interface and execute commands with root privileges, allowing them to hide or delete indicators of compromise. Fixed releases are ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12; no workarounds exist beyond restricting traffic with infrastructure ACLs. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving US federal agencies three days to patch under BOD 26-04.

SecurityWeekupdated · 16m agofirst · 4h agoExploit / PoC in the wild 19 sourcesCVE-2026-76460