Weekly AppSec Threat Digest — Sep 11–18, 2026
Actively exploited zero-days in Cisco ISE (root RCE) and Secure Email Gateway (SQLi to root), GitLab unauthenticated path traversal in KEV, Issabel hard-coded JWT secret exploitation, Unbound DNSSEC heap overflow, ransomware targeting VMware vCenter, and the BragJack agentic browser attack class.
By The Xalgorix Team
This week is unusually heavy on actively exploited infrastructure bugs. The systems organizations deploy to route corporate email, govern network access control, host code repositories, and manage private clouds have become the primary initial-access vector for both state-sponsored adversaries and ransomware syndicates.
Over the past seven days, active in-the-wild exploitation was confirmed for two catastrophic Cisco vulnerabilities: a CVSS 10.0 pre-authentication bypass in Identity Services Engine (ISE) yielding unauthenticated root command execution, and a CVSS 9.8 pre-auth SQL injection in Cisco Secure Email Gateway that triggers root remote code execution simply by receiving a crafted email message. Both flaws were quickly added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Simultaneously, watchTowr detected live internet-wide scanning and probing within hours of disclosure for an unauthenticated repository commits API path traversal in GitLab CE/EE (CVSS 10.0), which permits attackers to extract server secrets, tokens, and source code in a single HTTP request.
Compounding this perimeter pressure, Shadowserver observed active exploitation of hard-coded HS256 JWT secrets across exposed Issabel PBX installations, while CISA escalated the threat status of a previously disclosed VMware vCenter RCE bug after confirming active weaponization by ransomware syndicates. Meanwhile, on the research frontier, Forever Security published “BragJack,” uncovering a critical prompt-forcing vulnerability across five major agentic browser platforms (Chrome, Edge, Opera, Perplexity, and Claude in Chrome), netting over $20,000 in bug bounties and signaling a major shift in web application threat modeling.
What to do first: September 11–18 Action Matrix
| Priority | Target / CVE | Severity & Impact | Status / In-The-Wild | Immediate Action |
|---|---|---|---|---|
| P0 | Cisco ISE & ISE-PIC | CVE-2026-76460 · CVSS 10.0 · Pre-auth Root RCE | Actively exploited (CISA KEV Sep 16) | Apply patch immediately (no workaround); inspect ise-kong/access.log; re-image compromised nodes |
| P0 | Cisco Secure Email Gateway | CVE-2026-76461 · CVSS 9.8 · Pre-auth SQLi to Root RCE | Actively exploited (CISA KEV Sep 14) | Upgrade AsyncOS branches; audit mail queue, delivery logs, and child process trees |
| P0 | GitLab CE & EE | CVE-2026-85706 · CVSS 10.0 · Arbitrary File Read | Active probing observed (CISA KEV) | Upgrade to 19.3.2, 19.2.6, or 19.1.8; monitor POST requests containing file.path |
| P0 | Issabel Framework / PBX | CVE-2026-89026 · CVSS 9.8 · Hard-Coded JWT to Root RCE | Actively exploited (Shadowserver) | Update framework to generate installation-specific secrets; restrict /pbxapi/ access |
| P1 | VMware vCenter Server | CVE-2026-59310 · CVSS 9.8 · Management Plane RCE | Ransomware weaponization confirmed | Treat unpatched nodes as presumed compromise; execute DFIR triage prior to patching |
| P1 | Unbound DNS Resolver | CVE-2026-81642 · CVSS 9.1 · DNSSEC Heap Overflow | Public disclosure (NLnet Labs) | Upgrade to Unbound 1.26.1 or apply upstream DNSSEC validator patch |
| P2 | Jenkins Ecosystem | 20 Flaws (13 Plugins) · Groovy Sandbox Bypass / RCE / XSS | Vendor advisory (Sep 17) | Audit controller plugins; update 13 vulnerable packages across build automation fleets |
1. High-Severity CVEs
CVE-2026-76460 — Cisco ISE / ISE-PIC (CVSS 10.0, Actively Exploited)
On September 16, CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog after Cisco confirmed active in-the-wild exploitation of a critical pre-authentication flaw in Cisco Identity Services Engine (ISE) and ISE Passive Identity Controller (ISE-PIC).
The vulnerability resides within the authentication handling mechanism exposed on the web-based management interface. An unauthenticated, remote attacker can send specially crafted HTTP requests to bypass authentication controls entirely. Once bypassed, the attacker can leverage subsequent internal API commands to execute arbitrary operating system commands with root privileges.
Because Cisco ISE serves as the centralized policy, RADIUS, and TACACS+ enforcement point for network access across large enterprises, a compromise here is devastating: it gives the attacker root access on the policy engine that controls who gets access to what across the entire corporate switching and wireless fabric.
Remediation & Forensics: Cisco confirmed there are no workarounds. Fixed releases have been published for all supported trains:
- Cisco ISE 3.1 — Upgrade to Patch 12
- Cisco ISE 3.2 — Upgrade to Patch 11
- Cisco ISE 3.3 — Upgrade to Patch 12
- Cisco ISE 3.4 — Upgrade to Patch 7
- Cisco ISE 3.5 — Upgrade to Patch 4
Defenders should immediately inspect ise-kong/access.log for unusual, malformed, or suspicious username tokens hitting administrative routes. Crucially, if telemetry indicates that an ISE node was successfully targeted prior to patching, the node must be completely re-imaged. Because root privileges allow adversaries to hide kernel modules, erase logs, and modify underlying system binaries, in-place patching of an already-breached node provides no guarantee of cleanliness.
Read the primary coverage on The Hacker News.
CVE-2026-76461 — Cisco Secure Email Gateway (CVSS 9.8, Actively Exploited)
Just two days prior to the ISE advisory, CISA added CVE-2026-76461 to the KEV catalog on September 14 after Arctic Wolf Labs and Cisco confirmed active exploitation of a pre-auth remote code execution vulnerability in Cisco Secure Email Gateway (formerly Email Security Appliance / IronPort).
This is an exceptionally dangerous flaw: it stems from an improper sanitization defect in the AsyncOS email parsing component, leading to pre-authentication SQL injection that can be chained into root-level remote code execution. Because email gateways are fundamentally designed to accept incoming SMTP connections from anywhere on the internet, an attacker can compromise the gateway simply by transmitting a specially crafted email message. No valid credentials, user interaction, or administrator intervention is required.
Remediation & Investigation: Organizations running Cisco Secure Email Gateway must upgrade to the patched AsyncOS builds immediately:
- AsyncOS 15.5 branch — Upgrade to 15.5.5-0141
- AsyncOS 16.0 branch — Upgrade to 16.0.4-3021
- AsyncOS 16.5 branch — Upgrade to 16.5.0-780
Threat hunting teams must audit incoming mail logs and inspect system processes for anomalous child processes spawned by AsyncOS mail processing daemons, unexpected outbound connections on non-mail ports, and modifications to quarantine or archiving settings.
Read the technical analysis from Arctic Wolf Labs.
CVE-2026-85706 — GitLab CE/EE (CVSS 10.0, Exploitation Observed)
On September 10, GitLab released critical security updates addressing CVE-2026-85706, an unauthenticated path traversal vulnerability affecting the repository commits API in GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the issue a maximum CVSS score of 10.0.
watchTowr Intel observed automated scanning and probing against internet-facing GitLab instances almost immediately after disclosure. Given the low complexity of exploitation and the public availability of weaponized proof-of-concept scripts, CISA promptly added CVE-2026-85706 to the KEV catalog.
Under specific conditions, an unauthenticated remote attacker can supply directory traversal sequences through the repository commits API, allowing them to read arbitrary files from the underlying server filesystem. This provides an immediate avenue for adversaries to exfiltrate GitLab application secrets (secrets.yml, db_key_base), database configuration and connection passwords, CI/CD pipeline variables, personal access tokens, and private source code repositories.
Remediation & Hunting: The vulnerability affects GitLab versions from 18.7 up to 19.1.7, 19.2.5, and 19.3.1. Organizations running self-managed GitLab instances must upgrade immediately to the fixed versions:
- GitLab 19.3 — Upgrade to 19.3.2
- GitLab 19.2 — Upgrade to 19.2.6
- GitLab 19.1 — Upgrade to 19.1.8
Hunt across web proxy, Nginx, and GitLab production logs for anomalous POST requests hitting repository commit API endpoints containing file.path parameters with path traversal characters (../, encoded %2e%2e%2f, or direct filesystem targets). If evidence of successful extraction of secrets.yml is found, assume all database keys, CI/CD variables, and integration tokens have been compromised and rotate them immediately.
Read the comprehensive rapid reaction analysis from watchTowr.
CVE-2026-89026 — Issabel Framework / PBX (CVSS 9.8, Actively Exploited)
A textbook architectural failure in cryptography has led to widespread automated exploitation across enterprise voice systems. Researchers revealed that Issabel Framework—the popular open-source unified communications and PBX platform based on Asterisk—shipped the exact same hard-coded HS256 JWT signing secret key across all installations worldwide.
Because the signing key is static and known, any remote attacker can generate valid, cryptographically signed administrator bearer tokens. Armed with a forged token, an attacker can authenticate to the /pbxapi/manager/originate endpoint and instruct Asterisk's built-in System application to execute arbitrary operating system commands with the privileges of the PBX daemon without requiring any prior authentication.
The Shadowserver Foundation confirmed that threat actors began automated internet-wide scanning and exploitation starting September 9, weaponizing exposed PBX instances for cryptomining, VoIP toll fraud, and persistence inside corporate networks.
Remediation: Apply the latest Issabel Framework updates immediately. The official patch replaces the static global key with an installation-specific, randomly generated cryptographic secret. Additionally, PBX management interfaces, Asterisk management ports, and /pbxapi/ endpoints should never be exposed directly to the public internet; enforce strict VPN or IP whitelist boundaries.
Read the exploitation details on The Hacker News.
CVE-2026-81642 — Unbound DNS Resolver (CVSS 9.1)
NLnet Labs disclosed a critical vulnerability in Unbound, the high-performance validating, recursive, and caching DNS resolver used extensively by enterprise infrastructures, cloud providers, and Linux distributions. Tracked as CVE-2026-81642, the vulnerability is a heap buffer overflow in Unbound's DNSSEC validation subsystem.
All Unbound releases through version 1.26.0 are vulnerable. By configuring a malicious DNS authoritative zone with specifically crafted, malformed DNSSEC records, an attacker can trigger memory corruption when an Unbound resolver attempts to validate responses from that zone. This heap overflow can lead to immediate daemon crashes (denial of service) or potentially remote code execution within the context of the Unbound process.
While active in-the-wild exploitation has not yet been reported, weaponization is highly feasible because any client or application on a protected internal network can be induced to resolve a domain pointing to the attacker's authoritative name server, triggering the vulnerable validation routine.
Remediation: Upgrade all recursive resolvers to Unbound 1.26.1 immediately. For environments where binary packages are delayed or custom embedded builds are maintained, NLnet Labs has released targeted source code patches to sanitize the DNSSEC buffer allocation logic.
Read the advisory report on The Hacker News.
CVE-2026-59310 — VMware vCenter Server (CVSS 9.8, Ransomware Exploitation)
While CVE-2026-59310 is not a newly disclosed vulnerability, its operational threat status underwent a critical escalation this week: CISA confirmed that ransomware syndicates are now actively weaponizing this critical VMware vCenter remote code execution flaw in live extortion campaigns.
vCenter Server is the central control plane for VMware vSphere virtualized datacenters and private clouds. Gaining remote code execution on a vCenter controller gives adversaries unfettered command over all connected ESXi hypervisors, storage volumes, and guest virtual machines. In observed ransomware operations, attackers exploit vCenter to disable backup jobs, terminate security sensors across guest VMs, and execute automated mass-encryption scripts directly against virtual machine disks (.vmdk files) across entire datacenters.
Defensive Imperative: Any organization with an unpatched vCenter Server instance accessible internally or externally cannot treat this as a routine patch backlog item. Unpatched vCenter installations must be treated as presumed compromises. Before applying the patch, execute a thorough digital forensics and incident response (DFIR) review: audit vCenter service logs, inspect SSH authorized keys across underlying appliances, check for unrecognized virtual machine snapshots, and verify backup repository immutability.
Read the ransomware exploitation bulletin on BleepingComputer.
2. Web App Security Research
BragJack — Indirect Prompt Injection & “Prompt-Forcing” Against Agentic Browsers
As browsers evolve from passive rendering engines into autonomous AI agents capable of navigating websites, filling forms, and executing transactions on behalf of users, a new class of authorization vulnerabilities has emerged. This week, researcher Gal Weizman and the team at Forever Security published groundbreaking research detailing “BragJack,” a universal exploit technique targeting browser-integrated AI assistants.
The research demonstrated successful attacks across five prominent agentic browser environments:
- Google Chrome (integrated Gemini assistant)
- Microsoft Edge (built-in Copilot agent)
- Opera Neon
- Perplexity Comet
- Claude in Chrome (browser extension)
Unlike conventional prompt injection that attempts to slip instructions into the text an LLM reads, BragJack exploits an architectural design flaw in how browsers manage communication between extensions, web content, and the internal agent runtime. Through what the researchers term “prompt-forcing,” a malicious or compromised browser extension can hijack the agent communication bus and inject commands directly into the AI model's privileged execution context.
Once hijacked, the internal browser agent can be instructed to perform sensitive user actions with the user's full authority: reading private emails in webmail tabs, accessing local files, capturing screen contents or microphone/camera feeds, and executing actions on authenticated web services where the user already holds active sessions. The research earned over $20,000 in bug bounties across affected vendors and resulted in multiple CVE assignments.
AppSec Takeaway: For teams building AI-enabled web applications or agentic browser extensions, BragJack provides an unmistakable lesson: never rely on LLM system prompts or model-level guardrails to enforce authorization boundaries. DOM content and external messages must be treated as hostile inputs. Sensitive actions (file reads, token access, outbound API calls) require hard, non-bypassable programmatic authorization gates and isolated message channels that cannot be manipulated by untrusted contexts.
Read the full technical breakdown on Dark Reading and the original write-up at Forever Security.
Telegram Desktop — Stored JavaScript Execution Through Exported Chats
Security researchers published a compelling analysis of a stored cross-site scripting (XSS) and code execution vulnerability in Telegram Desktop. The flaw illustrates a frequently neglected AppSec boundary: safe rendering inside a client application does not ensure safe serialization when data is exported to external formats.
Researchers demonstrated that an attacker or malicious bot could deliver specially crafted messages containing hidden JavaScript payloads into a Telegram chat. While Telegram Desktop's native Qt-based interface rendered the messages safely and neutralized any in-app script execution, the application failed to apply strict contextual encoding when users invoked the built-in “Export Chat History” feature to HTML.
When a victim exports their chat history and opens the resulting HTML report in a standard web browser, the concealed payload executes within the browser's security context, allowing arbitrary JavaScript execution, access to local files referenced by the browser, and session theft.
AppSec Takeaway: Export pipelines (HTML, PDF, CSV, XML generation) must be treated as independent security boundaries with their own rigorous contextual sanitization and Content Security Policy (CSP) headers. Verifying that an application displays text safely on screen is only half the battle.
Read the disclosure details on The Hacker News.
Jenkins Plugin Security Advisory Batch (September 17, 2026)
On September 17, the Jenkins project published an extensive security advisory remediating 20 vulnerabilities across 13 distinct plugins. The batch includes multiple high-severity issues capable of Groovy sandbox bypasses, arbitrary remote code execution, cross-site scripting, and credential exposure in build controller logs.
CI/CD infrastructure represents the holy grail for modern attackers. A compromised Jenkins controller or worker node does not merely expose build scripts—it provides access to signing certificates, cloud deployment keys, Docker registry credentials, and source code repositories, enabling devastating software supply chain attacks.
Remediation: Audit your Jenkins plugin inventories immediately and update the 13 affected plugins through the Jenkins Plugin Manager. Restrict network access to Jenkins controller UI and agent ports, and ensure that agents operate in isolated, ephemeral containers with zero access to production secrets.
Review the full advisory coverage on GBHackers Security.
3. Bug Bounty Highlights
BragJack: $20K+ Across Browser Vendors & The New Frontier of Hunting
Beyond its academic and research value, Forever Security's BragJack disclosure is this week's strongest signal for bug bounty hunters. As browser vendors and AI developers race to integrate agentic assistants into desktop software and web applications, they are creating a brand new vulnerability class where the vulnerable boundary is not simply JavaScript or HTTP request handling—it is:
Untrusted Webpage / DOM Content ──> LLM Reasoning & Interpretation ──> Privileged Tool Execution
Because LLMs inherently treat their context window as instructions to follow, hunters can probe for subtle authorization breakdowns where an agent is coerced into invoking tools without explicit, informed human confirmation.
Practical Test Cases for Bug Bounty Hunters:
- Concealed DOM Injection: Embed instructions in elements hidden from visual rendering but parsed by browser accessibility trees or DOM extractors—such as
aria-labelattributes,<meta>tags, HTML comments, CSSopacity: 0overlays, and SVG<desc>nodes. Test whether asking the agent to “summarize this page” causes it to execute the concealed instructions. - Cross-Tab & Cross-Origin Context Bleed: Test whether an agent inspecting a public webpage can be instructed to read data from adjacent, authenticated tabs (e.g., extracting active session tokens, reading webmail snippets, or copying draft messages).
- Side-Effect Tool Chaining: Test whether the agent can be manipulated into executing irreversible actions (such as sending an email, initiating an OAuth permission grant, downloading a file, or modifying local browser settings) while reporting to the user that it merely completed a harmless text summary.
- Extension Message Hijacking: Inspect the messaging protocol between browser extension content scripts, background service workers, and internal agent APIs for missing origin validation or unauthenticated postMessage listeners.
4. Strategic Takeaways & Patch Order
The pattern worth paying attention to this week is far more useful than the raw CVE count: authentication boundaries around infrastructure management software are getting hammered, while agentic browsers are opening an entirely new web-security attack surface.
Adversaries have recognized that perimeter appliances (Cisco ISE, Cisco SEG, GitLab, Issabel PBX, VMware vCenter) represent the ultimate high-leverage entry points. They run with root privileges, handle sensitive network traffic, and often sit outside the monitoring scope of traditional endpoint detection and response (EDR) agents.
We recommend executing remediation in the following strict priority sequence:
At Xalgorix, our autonomous security scanner and PR security review engine continuously analyze code changes and infrastructure pull requests for these exact classes of flaws—including path traversal in API endpoints, hard-coded secrets and JWT signing keys, unsafe serialization and export pipelines, and missing authorization controls around AI agent tools.
Catch authorization bugs, path traversals, and hard-coded secrets before they reach production.
Add to GitHub→5. Sources & Primary Advisories
- Cisco Identity Services Engine (CVE-2026-76460) — The Hacker News: Cisco Warns of New Zero-Day ISE Auth Bypass
- Cisco Secure Email Gateway (CVE-2026-76461) — Arctic Wolf Labs: Active Exploitation of Cisco Secure Email Gateway Critical Zero-Day
- GitLab Community & Enterprise Edition (CVE-2026-85706) — watchTowr Rapid Reaction: GitLab Critical Path Traversal Vulnerability
- Issabel Framework PBX (CVE-2026-89026) — The Hacker News: Attackers Exploit Issabel Framework Hard-Coded Secret
- Unbound DNSSEC Validator (CVE-2026-81642) — The Hacker News: Critical Unbound DNSSEC Validator Flaw
- VMware vCenter Server (CVE-2026-59310) — BleepingComputer: CISA Warns Critical VMware vCenter RCE Flaw Now Exploited by Ransomware Gangs
- BragJack Agentic Browser Security Research — Dark Reading: BragJack — Browser Agentic AI Vulnerability & Forever Security Technical Overview
- Telegram Desktop Stored Script Execution — The Hacker News: Telegram Desktop Flaw Lets Hidden JavaScript Execute Through Exported Chats
- Jenkins Plugin Security Advisory (September 17, 2026) — GBHackers Security: Jenkins Patches 20 Flaws Across 13 Plugins
Ready to see it prove a bug?
Start a scan →