Cisco patches critical ISE command-exec flaw

Cisco's latest ISE vulnerability is a reminder that when identity infrastructure breaks, everything behind it is exposed. At the same time, CISA is redefining how quickly organizations are expected to respond to real-world threats, with patch timelines shrinking to days when exploitation is active. This episode breaks down what it means when your network access control layer becomes a pivot point, and why risk-based patching is quickly becoming the standard across both government and enterprise environments. There is also a closer look at how Google's new agent discovery standard could shape machine identity and trust, and why ransomware groups are scaling faster with new incentive models. We also cover Teams-based command and control abuse, third-party data exposure, and shifts in vendor risk. Learn more at https://crestvale.io

Transcript

SPEAKER_00 0:00

A core network access system just turned into a potential root shell, and a federal directive just reset how fast you are expected to patch when attackers are already moving. This is the Crestvale Newsroom Daily Podcast. Cisco has patched a critical flaw in Identity Services Engine, or ISE. This is not a fringe component. It is the control plane for who gets on your network. The issue allows an authenticated attacker with admin access to execute commands through crafted requests. From there, they can escalate to root. That turns ESE into a launch pad. In a single node deployment, exploitation can also knock the system offline. That means new devices cannot authenticate. Access control stops working at the front door. There is a second issue layered on top. An unauthenticated flaw exposes sensitive data, including hashed credentials. That raises the odds of getting to that initial admin foothold. Put those together and you have a clean path from exposure to control. This does not stay contained. Once the access layer is compromised, attackers can move laterally, harvest credentials, and pivot across the environment. Treat this like identity infrastructure compromise, not a device bug. If you are running ISE or ISE PIC, patch now. And assume that if credentials were exposed, you need to rotate and validate trust across systems tied to network access. This is one of those moments where the blast radius is defined by how central the system is. ISE is very central. Why this matters is simple. When the system that decides who is allowed on the network becomes the entry point, your zero trust posture collapses at the first gate. Now, Google is trying to get ahead of a different problem. Agent Sprawl. They have introduced an open specification called Agentic Resource Discovery, or ARD. The goal is to standardize how software agents find and connect to tools across organizations. Right now, every agent platform is a silo. There is no shared way to discover capabilities or verify who owns them. ARD changes that by tying discovery to domain ownership. Organizations publish signed catalogs on their own domains. That turns DNS into a trust anchor for agent interactions. There is also a registry layer. Think of it as a search engine for agent capabilities. That is where things get interesting. Whoever runs those registries will have visibility into what agents are doing and which tools they call. Google is already enforcing identity, egress policy, and tool pinning in its own registry. This is not about convenience. It is about control. If this model takes hold, agent-to-agent access will look a lot like identity and access management today. Verified ownership, policy at the edge, central visibility. The difference is the speed and scale. Agents will create connections far faster than humans ever did. If you do not define how your tools are exposed and verified, you will inherit someone else's trust model by default. Meanwhile, the Cybersecurity and Infrastructure Security Agency has raised the bar on patching. They replaced fixed timelines with a risk-based model tied to real-world exploitability. If a vulnerability is exposed, listed in known exploited vulnerabilities, and can be automated, the remediation window drops to as little as three days. That is not guidance. It is an expectation. The directive also changes how teams respond the moment a vulnerability hits that list. You move into incident posture quickly. You scope exposure, preserve data, and prepare for forensic work. This blurs the line between vulnerability management and incident response. It also forces continuous asset visibility. If something becomes internet exposed, your timeline can shrink instantly. This is aimed at federal agencies. It will not stay there. Expect this to show up in contracts, audits, and customer expectations. If your program cannot prioritize and act at this speed, it will be seen as a gap. There is also a shift in the ransomware market that is worth paying attention to. A group known as the Gentlemen is offering a 90-10 split to affiliates. That is pulling in experienced operators and increasing attack volume. They are already near the top by victim count this year. The model is simple. Better incentives attract better talent. Better talent executes faster. Initial access is coming through exposed VPNs and firewalls. Full encryption can happen within hours. That compresses your response window to almost nothing. This is what a more efficient ransomware economy looks like. Faster cycles, higher volume, less room for error on the defender side. Here's what else is worth knowing today. Dragon Force is hiding command and control traffic inside Microsoft Teams relays. That turns a trusted collaboration tool into a covert channel and forces you to treat internal SaaS as potentially hostile. Texas Parks and Wildlife exposed more than 3 million records through a third-party system. Your identity risk now extends to every vendor that touches your data. Kaspersky found malware delivered through Steam, using steganography to hijack accounts. Even benign content channels remain effective for credential theft. The National Cybersecurity Center reports that 75% of critical infrastructure attacks are state-linked. For essential services, this is now geopolitical competition. Broadcom is facing a lawsuit from Tesco over VMware pricing and support changes. Vendor lock-in is starting to show up as a security and operational risk, not just a cost issue. Here is the takeaway. If a system controls identity or access, treat any vulnerability in it as a full environment compromise until proven otherwise. Tomorrow we are watching how fast enterprises adopt risk based patch SLAs and whether vendors start aligning support and disclosure timelines to match. If this was useful, follow the Crestvale Newsroom Daily Podcast so you don't miss it. Thanks for listening.