Website filtering can be enforced at four points in a request's lifecycle. What each layer sees, what routes around it, and why network filters miss traffic.

Cisco has released a fix for a maximum-severity flaw in its Identity Services Engine (ISE) platform after confirming the bug was already being exploited by attackers. The vulnerability, tracked as CVE-2026-76460, carries a perfect CVSS score of 10.0 and was patched by Cisco on September 16, 2026.  The flaw sits in an API within Cisco Identity Services Engine and stems from inadequate authentication checks on an API endpoint. Because of this weakness, an unauthenticated attacker could send a specially crafted request to that endpoint and slip past ISE's web-based management interface entirely, gaining unauthorized access to the device without needing valid credentials. 

CISA Adds CVE-2026-76460 to Its Exploited Vulnerabilities List 

Given that Cisco confirmed active exploitation of CVE-2026-76460, the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, a designation reserved for bugs already being weaponized in real-world attacks.  Cisco ISE has long served as one of the most widely deployed network access control tools in enterprise environments, helping organizations manage security policies centrally, confirm the identities of users and devices, and govern who and what can reach different parts of a network. That central role is precisely what makes a bypass of its authentication so dangerous, according to security researchers. 

Experts Warn of Ransomware and Lateral Movement Risk 

John Strand, owner of Black Hills Information Security, echoed the urgency, recommending that affected organizations patch immediately and disconnect ISE instances from direct internet exposure. Strand also warned that the bug could plausibly be leveraged in a ransomware attack.   Even so, he noted that relatively few ISE deployments appear to be directly exposed to the open internet, which limits the number of organizations at risk from an opportunistic, internet-facing attack. His larger concern is what happens after attackers are already inside a network: "I'd be more concerned about it as a post-exploitation lateral movement opportunity.   An attacker gets into the environment through something else, discovers a vulnerable ISE internally, and uses that to expand access or compound the damage." 

Signs of Compromise and Recommended Checks 

Cisco's advisory notes that successful exploitation can hand attackers root-level command execution, meaning they could potentially erase or mask evidence of their intrusion. The company is advising administrators to cross-reference network and firewall logs from outside the affected device to spot unusual activity, including unexpected data transfers to external addresses. Suspicious usernames in the access logs are cited as one possible indicator of compromise, and Cisco recommends checking every node in a distributed deployment. 

Affected Products and Fixed Releases 

The vulnerability affects Cisco ISE and ISE Passive Identity Connector regardless of how a device is configured. No workarounds exist, though Cisco suggests using infrastructure access control lists to restrict management traffic as a temporary mitigation. Fixed releases are available for versions 3.1 through 3.5, including 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Version 3.0 has already reached the end of software maintenance, so organizations still running it are advised to migrate to a supported release.  The issue was discovered during a Cisco Technical Assistance Center support case, and the advisory was published in final form on September 16, 2026. 

An FTC report says that Americans last year lost $2.1 billion in social media scams, such as shopping and investment schemes. Social media site have become the place where most of these scams start, and more than half of that money was stolen in scams began on Facebook, WhatsApp, and Instagram.

The post U.S. Consumers Lost $2.1 Billion in Social Media Scams in 2025, FTC Says appeared first on Security Boulevard.

China-sponsored threat groups like Salt Typhoon and Flax Typhoon are increasingly relying on multiple massive botnets comprising edge and IoT devices to run their cyber espionage and network intrusion campaigns, CISA and other security agencies say. The use of such "covert networks" makes it more difficult to detect and mitigate their campaigns.

The post China-Backed Groups are Using Massive Botnets in Espionage, Intrusion Campaigns appeared first on Security Boulevard.

Introduction to BYOE Against the backdrop of organizations undergoing massive adoption of cloud services, it is critical to protect information from unauthorized access. The fact remains that most of the cloud service providers provide that most cloud services deliver strong encryption as a built-in feature, much of that worry arises when such service providers alsoRead More

The post What is Bring Your Own Encryption (BYOE)? appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.

The post What is Bring Your Own Encryption (BYOE)? appeared first on Security Boulevard.

DigiCert G1 Retirement 2026: A Turning Point in Web PKI Evolution Mozilla and Google Chrome will revoke the G1 root certificates of DigiCert on April 15, 2026. When the certificate you are using TLS chains to one of those roots, the browsers immediately do not trust it. A security warning is shown to your users.Read More

The post DigiCert G1 Root Removal 2026: What It Means, Risks & Action Plan for Your TLS Infrastructure appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.

The post DigiCert G1 Root Removal 2026: What It Means, Risks & Action Plan for Your TLS Infrastructure appeared first on Security Boulevard.

Introduction When it comes to sending data over the internet, two main protocols dominate the landscape: TCP, which stands for Transmission Control Protocol, and UDP stands for User Datagram Protocol. These protocols are important since they determine how information is transferred from one device to another. But what exactly are they, and how are theyRead More

The post TCP vs UDP: Difference, Examples, Future appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.

The post TCP vs UDP: Difference, Examples, Future appeared first on Security Boulevard.

PAM tools are too complex for most orgs. Here’s why legacy apps drive risk and how PEDM offers a simpler fix.

The post The Endpoint Paradox: Why Legacy Software Makes Enterprise PAM Solutions Wrong for Most Organizations appeared first on Security Boulevard.