Cisco Zero-Day, Apple Patches, Sogou RCE Exploit Headline Headlines
Cisco warns of actively exploited zero-day in ISE, Apple patches critical macOS flaws, and Sogou Input Method RCE is exploited.
Cisco is warning of a zero-day authentication bypass vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that is actively being exploited in the wild. The flaw, CVE-2026-20130, carries a CVSS score of 10.0 and allows unauthenticated attackers to elevate privileges. Cisco has released software updates to address this vulnerability. The Hacker News reported that this zero-day is being exploited in active attacks. Multiple other Cisco ISE and Nexus Dashboard vulnerabilities were also disclosed, including CVE-2026-20192, CVE-2026-20326, CVE-2026-20325, CVE-2026-20324, CVE-2026-20322, and CVE-2026-20242, all carrying critical severity ratings.
Apple has released security updates for macOS Golden Gate, Sequoia, and Tahoe, patching a total of 25 vulnerabilities. Among these is CVE-2026-65381, a critical validation issue in entitlement verification that could allow a malicious app to elevate privileges. The vulnerability was addressed with improved validation processes. SANS ISC and Vypr Intelligence noted the comprehensive security update.
A critical vulnerability in Sogou Input Method, CVE-2026-51990, allows for remote code execution with just one click. Versions prior to 16.3.0.3498 are affected. The vulnerability resides in the biz_helper.exe component. This flaw has been exploited by China-linked threat actors, specifically UNC3569, to deploy the GRAYRABBIT backdoor. The Hacker News and Cyber Security News detailed the exploitation and impact.
Microsoft has disclosed two critical vulnerabilities affecting its services. CVE-2026-69865, an authorization bypass in Microsoft Container Registry, allows privilege escalation over a network. Additionally, CVE-2026-69399 is an elevation of privilege vulnerability in Azure Arc. Both vulnerabilities have a CVSS score of 10.0 and are rated as high risk.
Several other critical vulnerabilities were disclosed, including CVE-2026-66012 in GitHub SiYuan, which involves missing authorization in a kernel endpoint, and CVE-2025-71338 in Flowiseai, a path traversal flaw allowing unauthenticated attackers to write files outside the intended directory. Apache Artemis is affected by CVE-2026-27446, a missing authentication vulnerability that could allow an unauthenticated remote attacker to force a broker to establish an outbound federation. CVE-2026-68536 in Apache MyFace Core presents a Server-Side Request Forgery and Local File Inclusion risk. Google also disclosed CVE-2026-56960, a use-after-free vulnerability in multiple locations that could lead to remote privilege escalation. WordPress plugins EduAdmin Booking (CVE-2026-62101) and Headless Single Sign On (CVE-2026-62108) have unauthenticated broken authentication flaws. Lastly, CVE-2025-56563 in Zenith Satellite Tracker 1.0 involves Server-Side Request Forgery.