TL;DR
Microsoft patched a maximum-severity Azure AI Foundry privilege escalation (CVE-2026-85889, CVSS 10.0). Cisco ISE authentication bypass (CVE-2026-76460, CVSS 10.0) and two other critical flaws are now on CISA’s Known Exploited Vulnerabilities list with federal remediation deadlines today. WordPress core vulnerability forces unauthorized theme installs; Gyazo image platform suffered numerous-record breach.
Executive Summary
- Microsoft Azure AI Foundry maximum-severity privilege escalation (CVE-2026-85889, CVSS 10.0) patched; impacted customers should validate fixes deployed.
- Cisco Identity Services Engine authentication bypass (CVE-2026-76460, CVSS 10.0) confirmed exploited in the wild; now on CISA KEV with federal agencies required to remediate by end of business today.
- WordPress core vulnerability allows crafted links to install malicious themes without explicit admin action, potentially chaining to remote code execution.
- Gyazo image-sharing platform disclosed theft of 23.6 million user records exploited through a server-side vulnerability.
- Pakistan-aligned Transparent Tribe APT deployed new Rust-based backdoor targeting Indian and Afghan government entities, using GitHub repositories for command-and-control.
Top Threats Today
1. Microsoft Azure AI Foundry Privilege Escalation (CVE-2026-85889)
Severity: CRITICAL Affected: Technology
Microsoft has released patches for a maximum-severity vulnerability in Azure AI Foundry tracked as CVE-2026-85889, which carries a CVSS score of 10.0 [1]. The flaw involves missing authentication for a critical function, allowing privilege escalation [1]. No customer action is required according to Microsoft’s advisory, indicating the patch is already available [1].
Sources:[1] The Hacker News
Recommended Action
- Verify that Azure AI Foundry instances are updated to the patched version immediately
- Review access logs for any unauthorized privilege escalation attempts prior to patch deployment
- Test patch deployment in staging environments before production rollout
2. Cisco ISE Authentication Bypass (CVE-2026-76460)
Severity: CRITICAL Affected: Government
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain an authentication bypass vulnerability (CVE-2026-76460) with a CVSS score of 10.0 [1][2]. An unauthenticated, remote attacker can gain unauthorized access to affected devices by bypassing the web-based management interface [2]. CISA added this CVE to its Known Exploited Vulnerabilities catalog on September 16, 2026, with federal agencies required to remediate by September 19, 2026 ⚠[2].
Sources:[1] Dark Reading[2] CISA KEV
Recommended Action
- Immediately inventory all Cisco ISE and ISE-PIC deployments in federal and critical-infrastructure networks
- Apply available patches from Cisco without delay; federal agencies must complete remediation today
- Monitor ISE admin interface logs for unauthorized access attempts from external IP addresses
- Temporarily restrict network access to ISE management interfaces to authorized subnets if patching is delayed
3. WordPress Core Theme Installation Vulnerability
Severity: HIGH Affected: Technology
WordPress released patches for a new vulnerability in its core software that allows a crafted web link, when opened by a logged-in administrator, to install a theme from the official WordPress.org directory without requiring the administrator to click an Install button [1]. This flaw can chain to code execution [1].
Sources:[1] The Hacker News
Recommended Action
- Update all WordPress core installations to the latest patched release immediately
- Review theme installation history for unexpected or unauthorized theme deployments in the past 30 days
- Restrict theme installation permissions to only trusted administrators; disable automatic updates for theme directories if custom themes are in use
- Educate administrators to avoid clicking untrusted links that target WordPress admin pages
4. Gyazo Image Platform Data Breach (numerous Records)
Severity: HIGH Affected: Technology
The Gyazo image-sharing platform confirmed a data breach affecting 23.6 million user records after attackers exploited a server vulnerability in its image upload infrastructure [1][2]. The breach allowed unauthorized access to user data [1].
Sources:[1] BleepingComputer[2] SecurityWeek
Recommended Action
- Gyazo users should reset passwords immediately and monitor accounts for unauthorized activity
- Organizations using Gyazo for internal documentation should assume data exfiltration and audit sensitive content shared via the platform in the past 12 months
- Coordinate with Gyazo on a timeline for patching the upload server vulnerability and require confirmation before resuming platform use
5. Transparent Tribe Rust Backdoor Campaign (India, Afghanistan Government)
Severity: HIGH Affected: GovernmentDefense
The Pakistan-aligned threat group Transparent Tribe (also tracked as APT36 and Earth Karkaddan) has been attributed to fresh cyber attacks targeting government and defense entities in India and Afghanistan [1]. The attacks employ a previously undocumented Rust-based backdoor, with command-and-control infrastructure hosted on private GitHub repositories [1]. According to Zscaler ThreatLabz, this represents an escalation in tooling sophistication ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Indian and Afghan government security teams should hunt for Rust binary execution patterns and GitHub API calls in network and endpoint logs dating back 60 days
- Block outbound connections to non-standard GitHub domains and unknown IP addresses from development and administrative workstations
- Review GitHub repository access logs for any suspicious clones or authentication from external IP ranges; revoke exposed personal access tokens
- Coordinate threat intelligence sharing with neighboring governments and Five Eyes partners on Transparent Tribe TTPs and IOCs
Additional Notable Threats
Public Exploits Released for Linux Kernel Root Escalation Flaws: A security researcher released working exploit code for four Linux kernel vulnerabilities that each enable local privilege escalation to root [1]. Kernel maintainers have patched all four; systems running up-to-date kernels are not affected [1].
Malware Campaign Impersonating LastPass via GitHub: An ongoing campaign uses SEO-optimized GitHub repositories to impersonate well-known software vendors, distributing a new information stealer called Rapuncel [7].
Google Pixel, Acronis Backup Flaws Added to CISA KEV: CISA added CVE-2026-58704 (Google Pixel improper authorization in cellular modem) and CVE-2026-87886 (Acronis Backup incorrect default permissions) to its Known Exploited Vulnerabilities catalog on September 16, with federal remediation due September 19, 2026 [31,33].
Abandoned CDN Domain Re-Registered; Thousands of Sites Still Reference It: A domain previously belonging to a defunct content delivery network was re-registered in July 2025; thousands of websites, code repositories, and documentation pages continue to pull assets from it, creating a supply-chain attack surface [5].
Today’s Action Checklist
- ☐ URGENT (by EOD): Verify Cisco ISE patches deployed on all federal agency and critical-infrastructure instances; CISA remediation deadline is today
- ☐ URGENT (by EOD): Patch CVE-2026-58704 (Google Pixel) and CVE-2026-87886 (Acronis Backup) on affected systems; federal remediation deadline is today
- ☐ HIGH (within 24 hours): Deploy Azure AI Foundry patches and validate no unauthorized privilege escalation in access logs
- ☐ HIGH (within 24 hours): Update all WordPress installations to latest core release and audit theme installation history
- ☐ MEDIUM (within 7 days): Scan internal networks for Rust binary execution and GitHub exfiltration patterns; review GitHub access logs for APT36/Transparent Tribe IOCs if government/defense sector
- ☐ MEDIUM (within 7 days): Audit dependency trees and CDN references for the re-registered abandoned domain; redirect or remove references to prevent supply-chain compromise