Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action

Two critical threats require immediate attention from UK businesses today. Cisco has disclosed an authentication bypass vulnerability in its Identity Services Engine with a maximum CVSS score of 10.0, and exploitation is already confirmed as active. ISE functions as a network gatekeeper for VPN, device compliance, and access control, making this vulnerability a direct path to your network perimeter. Separately, the GhostCode phishing technique weaponises Microsoft’s legitimate OAuth device code flow to bypass multi-factor authentication entirely. The attack arrives via business contact forms, presents victims with authentic Microsoft URLs, and produces valid session tokens that persist even after password resets. Analysis of ransomware activity in Japan reveals that 80 per cent of victims had capital under one billion yen, confirming that small and medium businesses are the majority of targets, not the exception. With Windows 11 24H2 reaching end of support in October 2026, unpatched endpoints remain a consistent entry point in post-breach analysis. This briefing provides specific actions for patching, MFA hardening, conditional access policies, and session revocation.

Chapters

• Introduction Mauven introduces two urgent threats: a Cisco vulnerability with active exploitation and a phishing technique that bypasses MFA controls most organisations rely on.
• Cisco ISE Authentication Bypass (CVSS 10.0) Analysis of the critical Cisco Identity Services Engine vulnerability with confirmed active exploitation, explaining why network access control systems are high-value targets and providing immediate patching guidance.
• Call to Action Encouragement to follow the show and share with business owners and IT providers who need timely threat intelligence.
• GhostCode OAuth Device Code Phishing Detailed breakdown of the GhostCode phishing kit that abuses Microsoft’s OAuth 2.0 device authorisation flow to bypass MFA, including detection indicators and specific mitigation steps.
• Ransomware Targeting of Smaller Businesses Analysis of Cisco Talos data showing 80 per cent of ransomware victims in Japan were small and medium enterprises, challenging the assumption that smaller size reduces risk.
• Windows 11 24H2 End of Support Reminder that Windows 11 24H2 Home and Pro editions reach end of support in October 2026, with guidance on fleet assessment and update planning.
• Outro Recap of the two key takeaways: immediate patching and verification actions, and the structural reality that small businesses are primary ransomware targets.

Links

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-FweYPvM8
• https://www.esentire.com/blog/ghostcode-phishing-campaign-targets-businesses-via-contact-forms
• https://blog.talosintelligence.com/threat-roundup-0905-0912/
• https://support.microsoft.com/en-us/windows/windows-11-version-24h2-update-history-0929c747-ca28-4e21-93d3-0d56f5c7f1b4