# IT Daily Roundup – September 18, 2026

> Sep 18, 2026 · #security #cisco #ai

Actively exploited Cisco ISE zero-day (CVSS 10.0), critical Check Point Management Server flaw patched, and a single malicious browser extension can hijack AI assistants across five browsers.

## 1. Cisco ISE Has an Actively Exploited Zero-Day with Maximum CVSS 10.0

Cisco released an emergency security patch for Identity Services Engine (ISE) – vulnerability CVE-2026-76460 received the maximum CVSS 10.0 rating. The flaw stems from insufficient authentication on an API endpoint: an unauthenticated attacker can send a specially crafted request, bypass login to the web interface, and execute commands with root privileges. Affected versions include ISE 3.1 through 3.5 and the ISE Passive Identity Connector (ISE-PIC) – patches are available in releases 3.1p12, 3.2p11, 3.3p12, 3.4p7, and 3.5p4. Cisco confirmed active exploitation in the wild, and CISA added the vulnerability to its KEV catalog on September 16 with a patching deadline of September 19 (tomorrow).

> **Why this matters:** Cisco ISE acts as the "gatekeeper" for an entire corporate network – it controls who can connect to Wi-Fi, VPN, switches, and wireless infrastructure. Root access on an ISE server gives an attacker the keys to network access policies and typically to the entire company infrastructure. If you run ISE in your organization, patching today is priority number one – no workaround exists, and the only interim measure before patching is restricting access to the ISE management interface via ACLs.

## 2. Check Point Management Server Patches Critical Flaw – A Single Login Request Is Enough for Root Access

Check Point released a fix for the critical vulnerability CVE-2026-91843 (CVSS 9.8) in its Security Management and Log Servers. An unauthenticated attacker can send a login request with an abnormally long username, triggering a stack overflow and enabling arbitrary code execution as root – meaning full control over the server that manages all firewall policies and administrative access. Affected versions include R82.20, R82.10 (Jumbo Hotfix ≤44), R82 (Jumbo Hotfix ≤126), R81.20 (Jumbo Hotfix ≤166), and earlier. The fix is available via Check Point LivePatch (reference sk1000155), and systems with automatic updates are already protected. Active exploitation has not been confirmed so far.

> **Why this matters:** Check Point firewalls and management servers are among the most widely deployed security appliances in business environments. A management server is an extremely high-value target – whoever controls it controls all network security policy. Even though exploitation hasn't been confirmed yet, a CVSS 9.8 score and a trivially simple exploit (just one HTTP request with a long username) make this a prime target that attackers will eventually notice. LivePatch provides rapid protection without a full upgrade; check your Check Point Management Server version and apply the patch as soon as possible.

## 3. One Malicious Browser Extension Can Hijack AI Assistants in Chrome, Edge, and More

Security researchers at Forever Security documented an attack in which a single malicious browser extension can manipulate AI assistants built into five popular browsers – including Google Gemini Live in Chrome, Copilot in Microsoft Edge, Perplexity Comet, Opera Neon, and Claude in Chrome. The extension needs only two common permissions (webpage modification and declarativeNetRequest – the same permissions used by typical ad blockers) to inject its own commands directly into the trusted context of an AI assistant. The highest impact was observed with Perplexity Comet, where the attack enabled access to files, browsing history, screenshots, and full control over the AI agent. Chrome 143.0.7499.192+ and Edge 150.0.4078.48+ include a fix; for other browsers, the recommendation is to remove unnecessary extensions and keep the browser up to date.

> **Why this matters:** Browser-based AI assistants have become a part of everyday work – employees use them to process emails, documents, and sensitive internal data. An attacker who delivers a malicious extension (e.g., via phishing or a fake productivity tool) can "instruct" the AI assistant to relay the contents of work sessions. For businesses, this translates into two concrete actions: (1) ensure Chrome and Edge are updated on all workstations (ideally automatically via MDM), and (2) implement a policy restricting browser extension installation to an approved list – achievable via Group Policy for both Chrome and Edge.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-18-it-daily-roundup.html