Field Notes — Week of September 20, 2026
A short, opinionated digest of what actually mattered this week across cloud, security, AI, and automation — and what it means if you run real systems.
Security & IAM: a 10.0 in the box that decides who gets on the network
CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog on September 16. It is an unauthenticated authentication bypass in Cisco Identity Services Engine and ISE Passive Identity Connector, CVSS 10.0, classified as CWE-648 (incorrect use of privileged APIs). The flaw sits in the ise-kong API gateway — the REST interface ISE uses for management operations — and a crafted request to the affected endpoint bypasses the web management interface entirely, leading to privileged access and command execution as root. First fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4.
Cisco confirmed active exploitation on September 16, having found the flaw while working a customer TAC support case — meaning at least one enterprise was already compromised before the advisory existed. CVE-2026-87886 (Acronis Backup, incorrect default permissions) landed the same day, and CVE-2025-39682 (Linux kernel) followed on September 18.
The take: ISE is not a network appliance with an identity feature; it is the policy decision point for everything that authenticates onto your network. Root on ISE means the attacker writes the authorization rules — no lateral movement required, because ISE will issue the access for them. And note where the bug lived: a management API gateway, not the login page. Most organizations threat-model the admin UI and treat the API behind it as an implementation detail. Patch this weekend, then go check whether ISE management interfaces are reachable from anywhere other than a jump host.
AI: AWS rebuilds the agent runtime around the cost model
AWS shipped a new AgentCore Runtime in Amazon Bedrock AgentCore on September 18 — the serverless microVM compute layer, rewritten. Two numbers matter. Cold start is now a P75 of 1.9–2.0 seconds for container images between 200 MB and 2 GB, against 5.4–30 seconds on the previous version, and consistent regardless of image size or concurrency. And memory is now elastic: sessions start on a small profile, grow on demand, and unused memory is reclaimed mid-session, so billing tracks actual usage rather than peak. Available in us-east-1, us-east-2, us-west-2, eu-west-1, ap-northeast-1.
The take: Cold start decoupled from image size removes the main reason teams were hand-slimming agent containers — engineering time spent on a constraint that no longer exists. The memory change is the bigger deal: peak-based billing is what makes agent economics unpredictable, because one long-context session sets the price for all of them. If you shelved an agent workload on unit-cost grounds in the last six months, the arithmetic changed this week.
Automation: compliance policy stops being a copy-paste exercise
HashiCorp made pre-written policies native in HCP Terraform on September 17, shipping ready-to-use Sentinel policy sets for CIS AWS Foundations Benchmark v1.2, v1.4 and v3.0 plus PCI DSS, deployable into an organization without assembling a policy library by hand. Intent-driven Terraform workflows for IBM Z followed on September 15, and on the fork side OpenTofu v1.13 introduced experimental linting across validate, plan and apply.
The take: The value here isn’t the policies — CIS rules have been publicly available for years. It’s that “we enforce CIS” stops requiring a team to own a policy repo, which is precisely the work that gets deferred and then silently rots. Adopt the pre-written sets as a floor, but resist treating the benchmark as the goal: a passing CIS score and a sound architecture overlap less than auditors assume.
Cloud: Azure tightens the token nobody tracks
Restriction of user delegation SAS to an Entra ID identity reached general availability on Azure, alongside Automatic Zone Placement for Virtual Machine Scale Sets in public preview and GA for Dell Managed PowerScale for Azure.
The take: SAS tokens are the classic untracked credential — issued once, pasted into a config, outliving the person who created it. Binding delegation to an Entra identity makes them revocable and attributable, which converts a standing blob-storage exposure into something your identity team can actually reason about. Turn on the restriction, then find out how many of your tokens break. That number is the finding.
ZelMor LLC helps organizations and consultancies with cloud architecture, AI enablement, security & IAM, and automation. If any of the above is a live question for your team, start a conversation.