--- title: "Cisco ISE Vulnerability ,Cisco Gateway Compromised, Revolut Breach Escalates | DMARC Report" description: "Cisco zero-days, Revolut’s breach, AI-driven attacks, malware, ransomware, and critical infrastructure threats define the evolving cybersecurity landscape." image: "https://dmarcreport.com/og/blog/cisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates.png" canonical: "https://dmarcreport.com/blog/cisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates/" --- Quick Answer Recent cyber threats include actively exploited zero-days, data breaches, AI-driven attacks, malware, ransomware, supply-chain compromises, and critical infrastructure vulnerabilities. Strong SPF, DKIM, DMARC, patching, and cybersecurity defenses help reduce these risks. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Cisco%20ISE%20Vulnerability%20%2CCisco%20Gateway%20Compromised%2C%20Revolut%20Breach%20Escalates%20&url=undefined%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F&title=Cisco%20ISE%20Vulnerability%20%2CCisco%20Gateway%20Compromised%2C%20Revolut%20Breach%20Escalates%20 "Share on Reddit") [ ](mailto:?subject=Cisco%20ISE%20Vulnerability%20%2CCisco%20Gateway%20Compromised%2C%20Revolut%20Breach%20Escalates%20&body=Check out this article: undefined%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F "Share via Email") ![Cisco Cybersecurity Vulnerability Breach](https://media.mailhop.org/dmarcreport/dmarc-check-5097-1790081125276.jpg) # **Cisco ISE Vulnerability ,Cisco Gateway Compromised, Revolut Breach Escalates** It was a brutal week for enterprise infrastructure and **consumer trust** alike. Cisco disclosed two actively exploited zero-days in as many days, Revolut’s data breach escalated into a public $3 million extortion attempt, and Spain logged what regulators believe is the first data breach carried out autonomously by an AI agent. Add in a hijacked HBO Max Reddit account, a supply-chain hit on marketing platform Brevo, and a fresh wave of ransomware claims, and it’s clear attackers aren’t slowing down as autumn sets in. ## Cisco’s Identity Services Engine hit by a perfect 10.0 zero-day Cisco rushed out emergency patches after confirming active exploitation of CVE-2026-76460, a **maximum-severity authentication** bypass in [Identity Services Engine (ISE)](https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/) and ISE-PIC. The flaw sits in an API endpoint with insufficient authentication controls, letting an unauthenticated attacker bypass the management interface entirely — and potentially gain root-level command execution. CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to patch. ([SecurityWeek](https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/)) ## …and a second Cisco zero-day hit its Secure Email Gateway Just two days before the ISE bug surfaced, Cisco confirmed a separate actively [exploited zero-day](https://www.helpnetsecurity.com/2026/09/20/week-in-review-cisco-patches-exploited-email-gateway-0-day-revolut-breach/), CVE-2026-76461, a [SQL injection](https://www.itnews.com.au/news/attackers-use-sql-injection-emails-to-root-cisco-gateways-628959) flaw in **Secure Email Gateway** appliances. Cisco’s incident response team says it first spotted exploitation activity back in 2025 and has now shared indicators of compromise so admins can check whether they’ve already been hit. ([Help Net Security](https://www.helpnetsecurity.com/2026/09/20/week-in-review-cisco-patches-exploited-email-gateway-0-day-revolut-breach/)) ## Revolut breach turns into a public $3 million shakedown ![Dmarc Record Generator 2079](https://media.mailhop.org/dmarcreport/dmarc-record-generator-2079-1790075807761.jpg) _Fintech giant Revolut confirmed that a hacker impersonating an Italian government agency tricked it into handing over customer data — including passports, driver’s licenses, verification selfies, and transaction histories — over a five-month period._ This week a group calling itself “iamnotavillain” publicly demanded roughly [$3 million](https://crypto.news/revolut-hackers-demand-3m-in-monero-after-data-breach/) in Monero, threatening to sell records tied to about **680 high-profile customers** within 24 hours. ([SecurityWeek](https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/)) ## Spain logs the first data breach allegedly executed by an AI agent Spain’s **data protection authority**, the AEPD, says it received a breach notification describing an attack chain carried out autonomously by an [AI agent](https://www.thestar.com.my/tech/tech-news/2026/09/16/spanish-data-watchdog-publicises-first-ai-agent-linked-data-breach-report#goog%5Frewarded) built on a mainstream large language model. The agent reportedly scanned for vulnerabilities, logged in, found a flaw, and then modified personal data and accessed invoices — all without a human directing each step. Regulators are treating it as an early signal that AI is compressing attack timelines dramatically. ([Reuters via The Star](https://www.thestar.com.my/tech/tech-news/2026/09/16/spanish-data-watchdog-publicises-first-ai-agent-linked-data-breach-report)) ## Hacked HBO Max Reddit account used to push malware ads Attackers [hijacked HBO Max’s verified Reddit account](https://www.malwarebytes.com/blog/news/2026/09/hbo-maxs-verified-reddit-account-hijacked-to-spread-malware) (u/hbomax) and ran 108 malicious ads over 48 hours as part of a campaign researchers are calling “PasteSwitch.” Victims were lured with a fake macOS app and pushed through **ClickFix-style prompts** that tricked them into pasting malicious commands into Terminal or PowerShell, delivering infostealers like MacSync and Amatera Stealer. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-hbo-max-reddit-account-to-push-malware-in-clickfix-ads/)) ## Brevo supply-chain attack served malware to 100,000+ websites ![Dmarc Lookup 1795](https://media.mailhop.org/dmarcreport/dmarc-lookup-1795-1790075846872.jpg)Marketing platform Brevo confirmed attackers stole a hardcoded Cloudflare [API key](https://www.fortinet.com/resources/cyberglossary/api-key) and used it to inject malicious scripts into its own site and widgets embedded across more than **100,000 customer websites**. For roughly five and a half hours, visitors saw a fake “verify you’re human” prompt that led to a [ClickFix attack](https://cybersecuritynews.com/brevo-supply-chain-attack/#google%5Fvignette), while logged-in WordPress admins risked having a backdoor plugin silently installed. ([BleepingComputer](https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/)) ## IDScan’s 153-million driver’s license breach keeps growing The fallout from identity-verification firm [IDScan’s breach](https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/) continued this week, with the company now facing multiple lawsuits after a dark-web marketplace called “Nexus” advertised over **153 million** U.S. and Canadian driver’s licenses, plus millions of ID cards, travel documents, and medical cards. _Investigative journalist Brian Krebs verified the data was real — even finding U.S. Defense Secretary Pete Hegseth’s license in the cache — and the FBI has opened an investigation._ ([BleepingComputer](https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/)) ## N0n ransomware group claims PayPal’s support vendor Transcom The [ransomware group N0n](https://www.dexpose.io/n0n-targets-transcom-worldwide-in-ransomware-attack/) says it breached Transcom WorldWide, the company that runs PayPal’s customer support operations, and is threatening to **leak 86.7 million** connection records unless it’s paid off. Neither Transcom nor PayPal has confirmed the scope of the claim publicly. ([DeXpose](https://www.dexpose.io/n0n-targets-transcom-worldwide-in-ransomware-attack/)) ## Same group hits the United Federation of Teachers N0n also claimed a separate attack on the **United Federation of Teachers**, a major U.S. labor union, threatening to leak over 181,000 sensitive documents if its demands aren’t met. _It’s part of a busy week for the group, which appears to be targeting large membership and support organizations for their bulk personal data._ ([DeXpose](https://www.dexpose.io/n0n-ransomware-group-targets-united-federation-of-teachers/))![Dmarc Lookup 3907](https://media.mailhop.org/dmarcreport/dmarc-lookup-3907-1790075878371.jpg) ## Panzer ransomware strikes a Paraguayan tech firm The [Panzer ransomware gang](https://cybersecuritynews.com/panzer-ransomware-targets/) claimed responsibility for an attack on Inovapy, a technology company based in Paraguay, warning that sensitive data will be published unless a ransom is paid. It’s one of several claims this week from Panzer, which has been targeting victims across multiple countries in short succession. ([DeXpose](https://www.dexpose.io/panzer-ransomware-strikes-inovapy-in-paraguay/)) ## Ransomware disrupts a Midwest water treatment facility A **water treatment facility** in the U.S. Midwest was hit by ransomware this week, disrupting operations and reportedly exposing sensitive data. The incident lands amid a broader wave of OT-focused warnings, underscoring how critical infrastructure remains a favored — and vulnerable — target. ([Security Boulevard](https://securityboulevard.com/2026/09/daily-ot-security-news-september-18-2026/)) ## Critical Siemens PLC flaw could let attackers manipulate industrial controls Siemens disclosed a critical vulnerability affecting multiple **programmable logic controller (PLC)** models that could allow unauthorized remote access and let attackers manipulate control systems. Patches are now available, and Siemens is urging all affected customers to update immediately given the risk to industrial operations. ([Security Boulevard](https://securityboulevard.com/2026/09/daily-ot-security-news-september-18-2026/))![Dmarc Record Generator 3906](https://media.mailhop.org/dmarcreport/dmarc-record-generator-3906-1790075923469.jpg) ## CISA pushes federal agencies to patch faster under BOD 26-04 This week’s Cisco ISE zero-day was folded into **CISA’s ongoing enforcement** of [Binding Operational Directive 26-04](https://shattered.io/cisa-kev-bod-26-04-deadline-2026/), which requires federal civilian agencies to prioritize patching based on real-world exploitation risk rather than treating all vulnerabilities equally. _The directive also requires agencies to check whether they were compromised before a patch was even applied — a notable shift in how “patch and move on” incident response is being treated._ ([SecurityWeek](https://www.securityweek.com/)) ## Google plans to restrict on-device ADB access after malware abuse Following a wave of [Android malware](https://cybernews.com/security/android-malware-uses-adb-from-inside/) abusing Wireless Debugging (ADB) to gain shell-level access without root privileges, reports this week detailed Google’s plans to tighten on-device ADB restrictions starting later in 2026\. **Security researchers** have flagged that legitimate developer tools like Shizuku could be affected, even as the change aims to close a path abused by malware that silently enables debugging mode to take over infected phones. ([DEV Community](https://dev.to/onsen/android-may-soon-restrict-on-device-adb-4lmk)) The growing threat landscape highlights why [SPF](https://dmarcreport.com/what-is-spf/), [DMARC](https://dmarcreport.com/), [DKIM](https://dmarcreport.com/blog/dkim-explained-how-dkim-works-and-why-is-dkim-important-for-organizations/), and strong [cybersecurity](https://dmarcreport.com/blog/how-to-stay-one-step-ahead-in-the-cybersecurity-race/) defenses are essential for protecting organizations against phishing, spoofing, malware, supply-chain attacks, and data breaches. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F) [ ](https://twitter.com/intent/tweet?text=Cisco%20ISE%20Vulnerability%20%2CCisco%20Gateway%20Compromised%2C%20Revolut%20Breach%20Escalates%20&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fcisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) - [ ![Cybersecurity ransomware news](https://media.mailhop.org/dmarcreport/dmarc-report-3120-1788259786008.jpg) Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Intermediate ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)[ Intermediate Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Sep 1, 2026 ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cisco ISE Vulnerability ,Cisco Gateway Compromised, Revolut Breach Escalates ","description":"Cisco zero-days, Revolut’s breach, AI-driven attacks, malware, ransomware, and critical infrastructure threats define the evolving cybersecurity landscape.","url":"https://dmarcreport.com/blog/cisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates/","datePublished":"2026-09-22T00:00:00.000Z","dateModified":"2026-09-22T00:00:00.000Z","dateCreated":"2026-09-22T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/cisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-check-5097-1790081125276.jpg","caption":"Cisco Cybersecurity Vulnerability Breach"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Cisco ISE Vulnerability ,Cisco Gateway Compromised, Revolut Breach Escalates ","item":"https://dmarcreport.com/blog/cisco-ise-vulnerability-cisco-gateway-compromised-revolut-breach-escalates/"}]} ```