Run Cisco Identity Services Engine? Patch it now

Week of 14 to 20 September 2026

Four items this week, two of them Cisco. Cisco Identity Services Engine (ISE), software that controls who and what can join a business's Wi-Fi, VPN or wired network, has a maximum-severity flaw criminals are already using. Cisco only found it after confirming a customer had been broken into, and there's no workaround. Cisco Secure Email Gateway, an appliance some businesses use to filter email, has a separate critical flaw under active attack, also with no workaround. Acronis Backup, a plugin some web hosts use to back up cPanel and Plesk websites, has a flaw already used in a handful of targeted attacks. And a joint advisory backed by Australia's Cyber Security Centre warns that a North Korean hacking group is posing as employers to steal from freelance developers and IT contractors, and that some genuine-looking applicants for that kind of work are themselves North Korean IT workers. If none of those situations apply to you, there's nothing here to act on this week.

1. 1

   Run Cisco Identity Services Engine? Patch it now16 Sept

   Organisations running Cisco ISE or ISE-PIC to manage network, Wi-Fi or VPN access, typically businesses with a dedicated IT team or an MSP managing multi-site network security, not a small office on standard router-and-firewall gear. If nobody set this up for you, you don't have it.

   Cisco Identity Services Engine (ISE) is software many mid-sized organisations use to control which devices and staff can join their network, deciding who gets Wi-Fi, VPN or wired access and what they can reach once connected. Cisco confirms criminals are already exploiting a flaw that lets an attacker skip the login screen entirely and run commands with full administrator control, erasing log entries to cover their tracks. Cisco only found the flaw while investigating a support case where a customer had already been broken into. There's no workaround: the fix is a software update, and Cisco has released one for every supported version.

   Do this

   Ask your IT provider: "Are we running Cisco ISE or ISE-PIC, and has it been patched to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Cisco Identity Services Engine flaw ↗ · Cisco security advisory ↗CVE-2026-76460 · CWE-648

2. 2

   Filter email through a Cisco appliance? Patch it today14 Sept

   Businesses running a Cisco Secure Email Gateway appliance, on-site or virtual, often set up by an IT provider managing email security separately from your everyday email platform. If Microsoft 365 or Google Workspace handles your spam and phishing filtering and this name doesn't ring a bell, it's not yours to worry about.

   Cisco Secure Email Gateway is a dedicated appliance (hardware or virtual) that some businesses run to filter email before it reaches inboxes, instead of relying only on Microsoft 365 or Google Workspace's built-in filtering. Cisco confirms criminals are already exploiting a critical flaw in it: a single specially crafted email is enough to make the appliance run the attacker's own commands with full root-level control, no password and no click required. Cisco says there is no workaround: patching is the only fix.

   Do this

   Ask your IT provider: "Do we run a Cisco Secure Email Gateway, and has it been updated to 15.5.5-0141, 16.0.4-3021, or 16.5.0-780?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Cisco Secure Email Gateway SQL injection ↗ · Cisco security advisory ↗CVE-2026-76461 · CWE-89

3. 3

   Host your website on cPanel or Plesk? Check for this Acronis backup plugin16 Sept

   Businesses whose website or email runs on cPanel & WHM or Plesk hosting with the Acronis Backup plugin installed, usually a call your hosting provider or web developer made, not something you configured yourself. If you don't manage your own hosting control panel, this is your host's job, not yours.

   Acronis Backup is a paid add-on many web hosts offer for cPanel & WHM and Plesk, the control panels widely used to run small business websites and email. Acronis confirms a flaw in the plugin lets someone who already has a low-level account on the server escalate themselves to full control, without needing to trick anyone into clicking anything. It's already been used in a small number of targeted attacks against cPanel & WHM sites; Plesk hasn't been hit yet but carries the same flaw. A fixed version is available for both.

   Do this

   Ask your web host or developer: "Do we run the Acronis Backup plugin for cPanel or Plesk, and is it updated to 1.9.3 HF3 (cPanel & WHM) or 1.8.11 (Plesk)?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Acronis Backup flaw ↗ · Acronis security advisory ↗CVE-2026-87886 · CWE-276

4. 4

   Hiring a freelance developer or IT contractor? Do these checks first18 Sept

   Businesses that hire freelance software developers, web developers or IT contractors (through gig platforms, freelance marketplaces or direct recruitment), especially for cryptocurrency, blockchain or AI-related work. If you don't hire freelance developers or IT contractors, there's nothing to act on here.

   A joint advisory from Japanese, US and German authorities, backed by Australia's Cyber Security Centre (ACSC), warns that a North Korean state-linked hacking group (tracked as "WaterPlum," also called "Contagious Interview") poses as employers to target freelance software developers and IT contractors. During fake job interviews or coding tests, the group tricks candidates into running malicious code that steals cryptocurrency, passwords and other data, and can spread into the hiring business's own systems. Separately, some genuine-looking applicants for freelance IT and development work are themselves North Korean IT workers using stolen or fake identities to earn foreign currency for the regime. Paying one, even unknowingly, can breach Australian sanctions law. The advisory reports at least 30,000 infected devices worldwide and 10.71 million USD in stolen cryptocurrency since December 2025.

   Do this

   Before you hire a freelance developer or IT contractor: verify their identity on a video call, be wary if they ask to be paid in cryptocurrency or into someone else's account, and don't let them run code on your systems that your IT provider hasn't reviewed first.

   Essential Eight: Restrict administrative privilegesISM: Managed services and outsourcing

   Sources: ASD's ACSC advisory: WaterPlum / Contagious Interview ↗

Latest ISM release: ISM September 2026: What Changed and What to Check →What the ISM is and how we assess it →