Cisco and Check Point face critical unauthenticated remote code execution flaws

cybersecurity vulnerabilities Cisco ISE Check Point zero-day exploit remote code execution

Major cybersecurity vulnerabilities have been identified in critical infrastructure products from Cisco and Check Point.

Cisco is addressing a maximum-severity zero-day flaw (CVE-2026-76460) in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The vulnerability, which carries a CVSS score of 10.0, allows unauthenticated remote attackers to bypass authentication via API endpoints. CISA has added this flaw to its Known Exploited Vulnerabilities catalog following reports of active exploitation.

Additionally, Cisco's Secure Email Gateway is facing an active exploit (CVE-2026-76461) involving SQL injection that enables unauthenticated remote code execution with root privileges. This flaw has a CVSS score of 9.8 and no known workarounds exist.

Check Point has also reported a critical stack-based buffer overflow (CVE-2026-91843) affecting its Security Management and Log Servers. Rated 9.8 on the CVSS scale, the flaw allows unauthenticated attackers to execute code as root by sending a login request with an excessively long username. Check Point has released a LivePatch to address the issue, noting that while there is no confirmed evidence of widespread exploitation, the severity warrants immediate action.

Entities

AsyncOS · CISA · Check Point · Cisco · Cisco Identity Services Engine · Cisco Secure Email Gateway

Claims

What the coverage asserts, and how many sources carry each claim.

[● 3 SOURCES] CISA has added both CVE-2026-76461 and CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalogue. totalsecurity.com.br · linuxsecurity.com
[● 2 SOURCES] CVE-2026-76460 allows unauthenticated remote attackers to bypass authentication on API endpoints in Cisco ISE and ISE-PIC. totalsecurity.com.br · linuxsecurity.com
[● 2 SOURCES] CVE-2026-76461 has a CVSS base score of 9.8 out of 10. flagthis.com
[● 4 SOURCES] CVE-2026-76461 allows unauthenticated attackers to execute arbitrary commands as root on Secure Email Gateway appliances via SQL injection. flagthis.com · scan.netsecurity.ne.jp · techtarget.itmedia.co.jp
[● 3 SOURCES] There are no workarounds available for the Secure Email Gateway vulnerability. flagthis.com · techtarget.itmedia.co.jp
[● 2 SOURCES] The vulnerability in Secure Email Gateway is being actively exploited in the wild. flagthis.com
[● 2 SOURCES] CVE-2026-76460 is a critical vulnerability in Cisco Identity Services Engine (ISE) with a CVSS score of 10.0. totalsecurity.com.br · linuxsecurity.com
[● 4 SOURCES] CVE-2026-91843 is a stack-based buffer overflow in the Security Management Server login process. cybernoz.com · forkast.news · sempreupdate.com.br · www.techjuice.pk
[○ 1 SOURCE] Cisco has released software updates to fix CVE-2026-76460. totalsecurity.com.br
[● 2 SOURCES] CVE-2026-76460 affects both Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). totalsecurity.com.br · dev.to
[● 3 SOURCES] CVE-2026-76460 has a CVSS score of 10.0. totalsecurity.com.br · linuxsecurity.com · dev.to
[● 3 SOURCES] CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog. totalsecurity.com.br · linuxsecurity.com · dev.to