Affected Systems

Cisco Identity Services Engine (ISE) - CVE-2026-76460 actively exploited. AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) vulnerable to Plugin4Shell RCE. Chrome and Edge browsers targeted by KREMLIN banking malware via malicious extensions. Multiple CVEs across Orkes Conductor, Google Pixel, Parallels Desktop, AWS SSM Agent, Dell storage, VLC, cPanel CSF, Okta, Palo Alto PAN-OS, and Linux kernel components.

Exploitation Status

Active exploitation confirmed for CVE-2026-76460 (Cisco ISE). Plugin4Shell PoC demonstrated for AI coding agents. KREMLIN malware campaign active since May 2025 targeting Brazilian banking customers. NightmareStresser DDoS service used for hundreds of thousands of attacks since 2022.

Business Impact

Cisco ISE auth bypass (CVSS 10.0) allows unauthenticated remote attackers full device access via API endpoint - critical for organizations using ISE for network access control. AI coding agent vulnerability enables zero-click RCE through malicious plugin substitution, bypassing SHA-pinning - affects development environments using Claude Code, Codex, Copilot, or Gemini CLI. KREMLIN malware steals credentials and session tokens from Chrome/Edge users via malicious extensions. OpenAI SSO misconfiguration chained with libheif RCE (CVE-2026-32882) demonstrates supply chain risk in identity infrastructure. Broad attack surface across trusted software components (browsers, plugins, authentication systems) increases organizational exposure.

Urgency

🔴 Immediate

Recommended Actions

  • Patch Cisco ISE immediately for CVE-2026-76460 - review API endpoint access logs for unauthorized authentication attempts and unusual activity since vulnerability disclosure
  • Update AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) to versions addressing Plugin4Shell SHA-pinning bypass - audit installed plugins for unexpected modifications
  • Scan Chrome and Edge browsers for unauthorized extensions - implement browser extension whitelisting and monitor for KREMLIN indicators (REF9334 campaign) especially in finance-facing systems
  • Update libheif to version 1.22.0 or later to address CVE-2026-32882 RCE - review SSO configurations for misconfigurations similar to OpenAI incident
  • Prioritize patching for CVE-2026-58138, CVE-2026-90894, CVE-2026-89049, CVE-2026-0310, and Okta CVEs (CVE-2026-85982, CVE-2026-78626, CVE-2026-78623) based on asset inventory