From Authentication Bypass to Cloud Pivot: Exploitation Is Moving Beyond the Initial Foothold

By SAFE Threat Research Team

An authentication bypass in Cisco ISE can end in root access. A pre-auth flaw in Marimo can expose cloud credentials and open a path to internal infrastructure. Linux kernel and Acronis vulnerabilities become useful once an attacker is already inside, providing additional ways to expand control.

That progression is the defining signal across this week’s CVEs. The vulnerabilities span network access control, developer infrastructure, Linux kernel components, PBX systems and backup integrations, but several share the same operational value: they help turn limited access into deeper compromise.

For defenders, that makes exploitability only the starting point. The more consequential question is what sits behind the vulnerable system – privileged credentials, management capability, adjacent workloads or another path deeper into the environment.

Vulnerability Landscape

Disclosure volume remained high this week, with 4,862 CVEs published and 2,317 rated critical or high severity. And exploit availability stayed comparatively limited: only 11 had a public exploit or PoC, and none showed weaponized exploit signals in the tracked dataset.

Trending Vulnerabilities

Confirmed exploitation skewed heavily toward vulnerabilities that were already known. Of the 16 CVEs showing in-the-wild activity, 11 were pre-existing issues rather than newly published ones – evidence that attacker attention is continuing to accumulate around vulnerabilities that remain operationally useful after disclosure.

That matters because this week’s exploited set is not concentrated in a single attack vector. It spans authentication bypass, remote code execution, kernel-level flaws, and privilege escalation.

Top CVEs to Watch

Cisco ISE CVE-2026-76460: Active Exploitation Reaches the Network-Access Control Plane

CVE-2026-76460 is a critical authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector. An unauthenticated remote attacker can send a crafted request to the affected API, bypassing the web management authentication boundary. Successful exploitation can progress beyond unauthorized management access to command execution with root privileges, giving an attacker control over a system positioned at the center of enterprise authentication and network-access policy. The vulnerability affects ISE and ISE-PIC regardless of device configuration, and there is no workaround.

Active exploitation has been confirmed. Administrators should review API gateway access logs across every ISE node and correlate them with network and firewall telemetry outside the appliance. Root-level access means on-device evidence could be altered or removed; where exploitation is suspected, rebuilding affected nodes and restoring from a known-good configuration is safer than treating the software update as sufficient remediation.

Marimo CVE-2026-39987: Pre-Auth Notebook RCE Leads Directly to Cloud Infrastructure

CVE-2026-39987 is a critical pre-authentication RCE vulnerability in the Marimo Python notebook platform. The /terminal/ws WebSocket endpoint accepted connections without performing the authentication validation enforced by other WebSocket routes, allowing an unauthenticated attacker to obtain an interactive terminal and execute commands in the context of the Marimo process. The issue is patched in Marimo 0.23.0.

Observed exploitation demonstrates why developer and data-science infrastructure can have an impact well beyond the initially vulnerable application. In one intrusion, the attacker moved from the exposed Marimo terminal to credentials available on the compromised instance, queried AWS Secrets Manager, retrieved an SSH private key and authenticated to a bastion host. The credential-to-bastion portion of the chain occurred within seconds.

The important exposure is therefore not simply notebook RCE. Systems used for development, analytics and AI workloads frequently operate close to cloud credentials, secrets and administrative infrastructure. CVE-2026-39987 shows how compromise of an internet-accessible development service can rapidly turn into a broader cloud access path when those trust relationships are available from the workload.

Linux Kernel CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266: Exploitation Spans Different Kernel Attack Surfaces

Three Linux kernel vulnerabilities were added to the Known Exploited Vulnerabilities catalog on September 18, but their placement in the same exploited set should not imply equivalent exposure. CVE-2025-39682 affects handling of zero-length records in the kernel TLS receive path, while CVE-2025-39964 is a race condition caused by concurrent writes to the same AF_ALG cryptographic socket. CVE-2026-53266 affects the bridge netfilter ebtables SNAT path, where ARP sender-address rewriting can result in an out-of-bounds write against memory that has not first been made writable.

The exploitation prerequisites differ substantially. CVE-2025-39964 requires local access to the AF_ALG interface and is therefore more relevant after an attacker already has a foothold. CVE-2026-53266 is also locally reachable and depends on specific bridge/netfilter functionality, with exploitation requiring the vulnerable ebtables processing path.

CVE-2025-39682 requires additional care when assessing exposure because public scoring currently differs on its attack vector: kernel-provided scoring characterizes it as network reachable, while NVD enrichment currently characterizes it as local. The underlying vulnerability is in kTLS record processing, so teams should validate the kernel version, distribution implementation and actual use of the affected functionality rather than prioritizing every Linux system identically.

The broader signal is that the confirmed exploitation is reaching kernel primitives with very different prerequisites, making configuration and reachable functionality critical to prioritization.

Acronis Backup CVE-2026-87886: Active Privilege Escalation Targets Hosting Backup Integrations

CVE-2026-87886 is a local privilege-escalation vulnerability caused by insecure file permissions in Acronis Backup integrations for Linux hosting environments. Affected products include the Acronis Backup plugin for cPanel & WHM, the extension for Plesk and the plugin for DirectAdmin. An attacker with existing low-privileged local access can exploit the permissions weakness to escalate privileges on the underlying server.

The vulnerability has confirmed exploitation and was added to the Known Exploited Vulnerabilities catalog. Its local attack vector is important when interpreting the threat: CVE-2026-87886 does not independently provide remote initial access. Instead, it becomes valuable after an attacker has already compromised a user, application or hosting account on the server.

That distinction increases its relevance in shared hosting and control-panel environments. A compromise that initially provides access to one workload can potentially be converted into control of the underlying host, expanding the blast radius across other applications, accounts and backup data managed from the same infrastructure. Remediation should therefore address both the vulnerable Acronis integration and the possibility that exploitation occurred after an earlier, separate foothold.

Issabel CVE-2026-89026: A Shared JWT Secret Converts Token Forgery Into Command Execution

CVE-2026-89026 affects the framework underlying Issabel PBX installations. Vulnerable versions contain the same hard-coded HS256 JWT signing key in the PBX API across installations. Because the signing secret is not unique, an unauthenticated attacker who knows the key can generate a valid bearer token instead of defeating authentication through brute force or credential theft.

The forged token can then be used against the PBX manager’s originate functionality in the Asterisk System application, causing arbitrary operating system commands to execute as the Asterisk service account. Exploitation activity was observed before the CVE was formally published, demonstrating that the weakness was already operationally useful by the time defenders first received a standardized identifier for it. The flaw is particularly notable because the attack path is deterministic: a reusable, product-wide cryptographic secret directly creates an authentication primitive, which then exposes an existing administrative capability that can execute commands.

What Security Teams Should Prioritize

The most important distinction this week is not simply whether a vulnerability is being exploited, but what level of access exploitation creates.

Cisco ISE and Marimo deserve immediate attention where exposed because they can provide attackers with a direct path into highly trusted infrastructure. In contrast, the Linux kernel and Acronis vulnerabilities become more dangerous after an attacker already has access, where they can help turn a constrained foothold into broader system control.

That difference should shape remediation. Internet-facing vulnerabilities that cross authentication boundaries or expose administrative capability should be addressed first, followed closely by local escalation paths on systems that are already attractive initial targets. For affected Issabel deployments, the hard-coded JWT secret effectively weakens the authentication boundary itself and should be treated accordingly.

The broader takeaway is that CVEs should not be evaluated in isolation. A vulnerability that appears limited on its own can become significantly more important when combined with exposed services, accessible credentials, privileged workloads, or another weakness elsewhere in the environment. For security teams, the practical priority is to identify where a single exploit can change the attacker’s position most dramatically – from unauthenticated to authenticated, from application access to host control, or from one system into the wider environment.

This is where a CTEM approach becomes valuable. SAFE CTEM helps teams move beyond CVE severity and isolated exploit signals by connecting vulnerabilities with asset exposure, security controls, and business impact. The result is a clearer view of which weaknesses can materially advance an attack and therefore deserve attention first.

As this week’s vulnerabilities show, the CVE itself is often only one step in the attack chain. Effective prioritization depends on understanding what that step enables next.