The Exploit Bulletin — Thursday, September 17, 2026: 3 issues require action
Thursday, September 17, 2026 — 3 issues require action. If you run none of the software below, you are done.
Affects: Cisco Identity Services Engine · Cisco ISE Passive Identity Connector on the same releases · Google Pixel devices with security patch level
1. Unauthenticated API request bypasses Cisco ISE management authentication (CVE-2026-76460)
CISA KEV (due 2026-09-19) · AUTHENTICATION BYPASS · CRITICAL · CVSS 10.0
Cisco published the advisory and fixes on 2026-09-16 after the flaw was exploited as a zero-day, and CISA added it to KEV the same day with a 2026-09-19 remediation deadline, so a team that leaves an affected ISE node reachable without upgrading is exposed to unauthenticated takeover of its access-control plane.
An API endpoint in Cisco Identity Services Engine and ISE Passive Identity Connector lacks sufficient authentication control, so a remote attacker who sends a crafted request can bypass the web-based management interface and gain unauthorized access to the device, regardless of configuration. ISE sits at the centre of network access control, so control of it exposes the policies and credentials that govern the rest of the network.
Affected: Cisco Identity Services Engine 3.1.0 p8, p9, p10; Cisco Identity Services Engine 3.2.0 p7; Cisco Identity Services Engine 3.3 Patch 1, Patch 2, Patch 3, Patch 4; Cisco Identity Services Engine 3.4.0 and 3.4 Patch 1; Cisco ISE Passive Identity Connector (ISE-PIC) on the same releases
How to Test: Confirm the installed ISE / ISE-PIC release and patch level against the affected list (3.1.0 p8–p10, 3.2.0 p7, 3.3 Patch 1–4, 3.4.0, 3.4 Patch 1); the flaw applies regardless of device configuration, so any node on those releases is vulnerable. Review web/API access logs on ISE admin nodes for unauthenticated requests to API endpoints from unexpected sources, and audit administrator sessions, newly created admin accounts, and policy or configuration changes since the advisory date for activity you cannot attribute.
How to Patch: Upgrade to the fixed ISE / ISE-PIC software Cisco released on 2026-09-16 for your release train (advisory cisco-sa-ISE-ABP-VNSW7Tn5, bug CSCww39530); Cisco states there are no workarounds. Until the upgrade is applied, restrict network reachability of the ISE administrative and API interface to trusted management networks only.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA adds CVE-2026-76460 to KEV based on evidence of active exploitation · SecurityWeek: exploited in the wild as a zero-day · BleepingComputer: Cisco warns of ISE zero-day exploited in attacks
2. Unauthenticated REST API authorization bypass grants admin access to Cisco ISE and ISE-PIC (CVE-2026-76423)
AUTHENTICATION BYPASS · CRITICAL · CVSS 10.0
Cisco published fixes on 2026-09-16 with no workaround, and BleepingComputer and The Hacker News report in-the-wild exploitation of the ISE REST API authentication bypass, so an unpatched ISE hands an outside attacker administrative control of the system that decides who gets on your network.
The Cisco ISE / ISE-PIC REST API web service is exposed with insufficient authorization checks, so a remote attacker with no credentials can send a crafted HTTP request to the REST API port and read or modify ISE configuration and identity data with administrative privileges. The same advisory bundles further ISE flaws enabling remote code execution, SQL injection and XXE.
Affected: Cisco Identity Services Engine 3.1.0 (base through patch 6); Cisco Identity Services Engine 3.2.0 (base through patch 2); Cisco ISE Passive Identity Connector (ISE-PIC) on the same releases
How to Test: Check the running ISE / ISE-PIC release and patch level against the affected list (3.1.0 through 3.1.0 p6, 3.2.0 through 3.2.0 p2). Determine whether the REST API port is reachable from untrusted networks, then review web-server and audit logs for unauthenticated or unexpected requests to the REST API and for administrative configuration or identity-store changes you did not make.
How to Patch: Upgrade to the fixed ISE / ISE-PIC software Cisco lists in advisory cisco-sa-ise-multi-hrP9jQSQ for the 3.1 and 3.2 trains; Cisco states there are no workarounds. Until the upgrade is applied, restrict network access to the ISE REST API port to trusted management hosts only.
Evidence: BleepingComputer: Cisco warns of ISE zero-day exploited in attacks (2026-09-17) · The Hacker News: Cisco warns of new zero-day ISE auth bypass (CVSS 10.0) exploited in active attacks
3. Cellular modem permission bypass gives attackers in radio range privilege escalation on Google Pixel (CVE-2026-58704)
CISA KEV (due 2026-09-19) · PRIVILEGE ESCALATION · HIGH · CVSS 8.8
Google shipped the fix in the September 2026 Pixel bulletin on 2026-09-15 and CISA added the CVE to KEV on 2026-09-16 on evidence of targeted exploitation; Pixel fleets left below the 2026-09-05 patch level stay open to a no-interaction modem-side compromise.
A logic error in the Pixel cellular modem lets an attacker on the adjacent (cellular) network bypass permission checks and escalate privileges without any user interaction, with full confidentiality, integrity and availability impact on the device. Google reports it has been used in limited targeted attacks.
Affected: Google Pixel devices with security patch level earlier than 2026-09-05
How to Test: On each Pixel, check the Android security patch level (Settings → About phone → Android version, per Google's 'Check and update your Android version' guidance); any device showing a patch level earlier than 2026-09-05 is affected. For managed fleets, pull the patch level from your MDM inventory. The published reports give no indicators of compromise for this flaw; treat unexplained modem/baseband crashes or reboots on unpatched high-risk users' devices as worth a forensic look.
How to Patch: Install the September 2026 Pixel update so the device reports security patch level 2026-09-05 or later (Settings → System → Software update); all supported Pixel devices receive this update. No vendor workaround is published for devices that cannot update.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA adds CVE-2026-58704 to KEV · The Hacker News: Google discloses in-the-wild exploitation · BleepingComputer: Pixel zero-day exploited in targeted attacks
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
