Critical Security Flaws Exposed in Major Enterprise Systems
Weekly recap reveals authentication bypasses and RCE vulnerabilities across Cisco, Google, AWS and more
1Cisco's maximum-severity auth bypass
Cisco disclosed an actively exploited authentication bypass vulnerability (CVE-2026-76460, CVSS 10.0) in its Identity Services Engine. The flaw stems from insufficient authentication controls on an API endpoint, allowing remote attackers to bypass web-based management interfaces. This marks another critical vulnerability in enterprise authentication systems following recent Okta and Palo Alto Network incidents.
2Patching velocity versus exploit speed
The gap between vulnerability disclosure and active exploitation continues to shrink dramatically. This week's list includes critical flaws in Google Pixel (CVE-2026-58704), AWS Systems Manager (CVE-2026-89049), and Dell Secure Connect (three CVEs). Security teams now operate in an environment where proof-of-concept code often appears within days of patch releases.
3Browser and plugin vulnerabilities surge
Google Chrome and Mozilla Firefox collectively disclosed over 30 critical vulnerabilities this week, ranging from memory corruption to RCE flaws. The volume underscores how browsers remain prime attack surfaces despite sandboxing efforts. Particularly concerning are the Chrome flaws (CVE-2026-91721 series) already being exploited in limited attacks.
4Enterprise software under fire
Multiple critical vulnerabilities hit core enterprise platforms including Okta (three CVEs), Parallels Desktop (ParaShells), and VLC Media Player. The Okta flaws (CVE-2026-78626 series) follow their recent breach disclosure, raising questions about identity provider security. Meanwhile, the Linux kernel DiagSpill vulnerability (CVE-2026-74469) affects numerous enterprise deployments.
5Cloud infrastructure vulnerabilities
AWS Systems Manager Agent (CVE-2026-89049) and ArangoDB (four GHSA IDs) joined the week's critical cloud vulnerabilities. These flaws often provide initial access vectors in cloud environments. The ArangoDB graph database vulnerabilities are particularly severe as they allow remote code execution without authentication.
6AI security challenges compound
As AI agents gain broader enterprise access, security teams lack adequate visibility and controls. This week saw Flowise (CVE-2026-91932) and MLflow vulnerabilities, highlighting risks in AI/ML toolchains. Attackers are increasingly leveraging AI for reconnaissance while defenders struggle to govern AI system access.
7Endpoint management risks
Dell (ObjectScale, Secure Connect), HPE (EdgeConnect), and Ivanti (Endpoint Manager) all disclosed critical endpoint vulnerabilities. The HPE SD-WAN gateways flaws (five CVEs) are especially concerning given their network positioning. These continue a trend of enterprise management tools becoming attack vectors.
8Shifting security priorities
This week's vulnerabilities demonstrate that 'trusted' systems require continuous verification. The concentration of flaws in authentication systems and management interfaces suggests attackers are focusing on identity and access pathways. Security teams must prioritize patching these critical paths over perimeter defenses.
Original article: The Hacker News — Critical Security Flaws Exposed in Major Enterprise Systems