Skip to content
feed: live
>_0dayNews
Briefing · 2026-09-18

Sep 18: Two CVSS 10 Zero-Days Active, Pixel Deadline Tomorrow

Cisco ISE and WSO2 both carry CVSS 10.0 flaws under active exploitation. Google Pixel modem zero-day CISA deadline lands September 19. MISP CLI exposes feed credentials.

tldr.txt
  • CVE-2026-76460 (Cisco ISE, CVSS 10.0): Active exploitation confirmed. Emergency patch released. No workarounds. All supported ISE releases affected. Unauthenticated REST API request grants full administrative access.
  • CVE-2026-5430 (WSO2, CVSS 10.0): JWT validation bypass, unauthenticated administrative access. Active exploitation confirmed. Patch available.
  • CVE-2026-58704 (Google Pixel modem, high-severity): CISA BOD 26-04 federal remediation deadline is September 19. Active exploitation confirmed. Fix is in the September 2026 Pixel update.
  • CVE-2026-90895 (MISP through 2.5.45, CVSS 9.8): CLI auth controls separate from web layer expose feed HTTP credentials and sync authkeys. Fixed in 2.5.46.
  • CVE-2026-14344 (Mattermost, CVSS 8.8): Board permission check not applied during board creation. Authenticated user can create boards regardless of role assignment. Four release branches affected.

Two CVSS 10.0 flaws under active exploitation. One CISA federal deadline landing tomorrow. September 17 was dense.

Cisco ISE: CVSS 10.0 auth bypass, exploitation active

CVE-2026-76460 (CVSS 10.0, critical). Unauthenticated REST API auth bypass in Cisco Identity Services Engine and ISE-PIC. A crafted request to the REST API grants full administrative access. No credentials required. No workaround available, per Cisco.

Exploitation confirmed. Emergency patches cover all supported ISE releases. Cisco flagged active attacks in the initial advisory.

ISE is NAC infrastructure: it manages network access decisions, posture assessment, and device trust. Administrative access reaches the policy layer that controls which devices and users get on the network.

Full coverage.

WSO2: CVSS 10.0 JWT bypass, exploitation confirmed

CVE-2026-5430 (CVSS 10.0, critical). JWT validation bypass in WSO2 Identity Server and API Manager. An unauthenticated attacker can forge a JWT and obtain administrative access to the affected deployment. Patch is available.

Active exploitation confirmed. WSO2 deployments commonly sit at the API gateway layer. Administrative access at that layer reaches whatever the gateway controls.

Full coverage.

Google Pixel CVE-2026-58704: CISA deadline is tomorrow

CVE-2026-58704 (high-severity). Privilege escalation in Pixel modem firmware. Exploitation confirmed in the wild. CISA added it to KEV under BOD 26-04: federal remediation deadline is September 19.

Tomorrow.

The September 2026 Pixel update patches 110 vulnerabilities total. CVE-2026-58704 is the exploitation-confirmed driver of the timeline. Federal agencies have one day remaining.

Full coverage.

Also on the board

  • MISP CVE-2026-90895 (CVSS 9.8): CLI access controls in MISP through 2.5.45 operate independently of the web application layer. A local user or attacker with local access can read feed HTTP credentials and sync authkeys stored in the CLI context. Fixed in 2.5.46. Instances where multiple users share local system access are in scope.

  • Mattermost CVE-2026-14344 (CVSS 8.8): Board permission check not applied during board creation. Any authenticated Mattermost user can create boards regardless of role assignment or workspace restrictions. Four active release branches affected. Fix is available via the Mattermost security advisory.

Sources