Actively Exploited Cisco and Oracle Flaws Dominate Unpatched Critical Risk

Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.

Unauthenticated remote command execution with root privileges affects Cisco Secure Email Gateway running affected AsyncOS builds (13.x, 14.x, 15.x and 16.x), where crafted inbound email can inject SQL into the mail-parsing pipeline and ultimately achieve OS-level code execution. Exploitation requires no authentication, no user interaction, and no non-default configuration per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N), so any internet-facing or mail-receiving appliance - the product's normal deployment role - is exposed. This is confirmed actively exploited (CISA KEV) with publicly available exploit code exists, and while EPSS is a moderate 2.16% (81st percentile), the KEV listing and total technical impact per SSVC make this a genuine top-priority issue rather than an inflated high-CVSS artifact.

Permission bypass in the cellular modem firmware of Google Android/Pixel devices allows a nearby unauthenticated attacker to escalate privileges without user interaction, achieving total technical impact (C:H/I:H/A:H) via crafted radio signaling. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though exploitation requires radio/RF proximity to the target baseband (adjacent, not Internet-remote) and SSVC deems it non-automatable. EPSS is low at 0.11% (2nd percentile).

Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server.

Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.

Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data.

Unauthenticated remote attackers can achieve full takeover of Oracle Platform Security for Java (OPSS) versions 12.2.1.4.0 and 14.1.2.0.0, an authentication-bypass flaw (CWE-287) in the Centralized Thirdparty Jars component of Oracle Fusion Middleware that carries a maximum CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Because the scope is marked as changed (S:C), Oracle warns that a successful compromise of OPSS - the shared security services layer that other Fusion Middleware components depend on - may significantly propagate impact to additional products, which is what elevates this above the otherwise near-identical 9.8-rated issue. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but Oracle characterises the flaw as 'easily exploitable' with no privileges or user interaction required, so the practical limiting factor is whether the affected middleware's HTTP surface is network-reachable - internet-exposed deployments are at the highest risk.

Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.