Cisco ISE, Android, and Steam Zero-Days Under Active Exploitation
Critical vulnerabilities in Cisco ISE, Android modem components, and Steam for Windows are being actively exploited, posing significant risks to enterprises and users.
This week's cybersecurity landscape is dominated by the active exploitation of several high-impact vulnerabilities, including a critical zero-day in Cisco Identity Services Engine (ISE) and a modem flaw affecting Google Pixel devices. Additionally, a proof-of-concept for an unpatched Steam for Windows zero-day has surfaced, raising concerns about potential widespread compromise.
Cisco has issued an urgent warning regarding CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass vulnerability in Cisco ISE and ISE-PIC. The flaw, stemming from insufficient authentication controls on an API endpoint, allows unauthenticated remote attackers to bypass the management interface and achieve command execution with root privileges. This grants attackers a powerful foothold to alter configurations, steal credentials, and move laterally within enterprise networks. Cisco is pushing immediate patches for supported versions, while urging migration from end-of-maintenance versions. Administrators unable to patch immediately are advised to restrict management traffic and monitor logs for suspicious activity.
Google has confirmed limited, targeted exploitation of CVE-2026-58704, a high-severity elevation-of-privilege flaw in the modem subcomponent of Pixel devices. This vulnerability, patched in the September 2026 Pixel Update Bulletin, allows an attacker within radio proximity to escalate privileges without user interaction. Such exploits targeting the baseband layer are often associated with sophisticated spyware. The September bulletin addresses a total of 110 vulnerabilities, underscoring the importance of timely updates for Pixel device owners, especially those nearing their end-of-life.
Adding to the threat landscape, a proof-of-concept exploit for an unpatched zero-day in Steam for Windows has been released by researcher KillaBoi. Dubbed "BrokenPipe," the exploit targets Steam's privileged Windows service (steamservice.exe) and allows a local, unprivileged user to gain SYSTEM-level privileges without requiring administrative credentials, a UAC prompt, or Steam authentication. The vulnerability reportedly stems from a signature-coverage gap that allows an attacker to trick the SYSTEM-level service into executing a malicious launcher. Valve has reportedly been aware of the issue since March, but a fix has yet to be released. Organizations are advised to monitor Steam installations and unusual processes running as SYSTEM.
Beyond these critical zero-days, the roundup highlights other significant security developments. A WordPress core vulnerability, Click2Shell, allows for the silent installation of attacker-chosen themes when an administrator clicks a crafted URL, which can then be chained with a theme-specific flaw to achieve remote code execution. Check Point has patched CVE-2026-91843, a critical stack-based buffer overflow in its Security Management Server that allows unauthenticated remote attackers to gain root-level OS control. Furthermore, a new Linux kernel vulnerability, ZcopyReaper (CVE-2026-43502), allows unprivileged local attackers to corrupt kernel memory and escalate to root privileges.
The convergence of these vulnerabilities underscores the persistent and evolving threat landscape. The active exploitation of zero-days in enterprise-grade software like Cisco ISE, coupled with privilege escalation flaws in widely used consumer platforms like Android and Steam, necessitates a proactive and vigilant security posture. Organizations must prioritize patching, implement robust network segmentation, and maintain vigilant monitoring for anomalous activity to mitigate the risks posed by these and other emerging threats.