Skip to content
Hermes Codex

Hermes Threat Observatory

2,841 Raw Signals
→
147 Significant Changes
→
23 High-Interest
→
9 Actionable Decisions
3 New CISA KEV Entries Confirmed active in-the-wild
6 Oracle CSPU (CVSS 10.0) Zero-auth middleware takeovers
4 Agentic AI Alerts Tool poisoning & privilege abuse
0 Vulnerabilities Downgraded Sustained adversary momentum

🚨 Critical Signals & Immediate Operational Decisions

Sorted by HTS Severity
CISA KEV / Existential Risk CVE-2026-76460 HTS 99/100
IMMEDIATE PATCH

Cisco ISE — Token-Replay Authentication Bypass & Super-Admin Takeover →

🔄 WHAT CHANGED

Added to CISA KEV catalog following active in-the-wild exploitation targeting Cisco ISE Guest Portal.

⚠️ WHY IT MATTERS

Unauthenticated remote attackers forge provisioning requests to grant themselves Super-Admin rights, compromising enterprise Zero Trust policy planes.

🎯 WHO IS AFFECTED

All enterprises running Cisco ISE 3.1 through 3.4 with exposed guest or administration portals.

Confidence rating: HIGH (100% — KEV + Weaponized PoC)
Explore Autopsy & Detection Rules →
Oracle September 2026 CSPU CVE-2026-83021 HTS 98/100
NETWORK ISOLATION

Oracle WebLogic Server — Unauthenticated T3/IIOP Deserialization RCE →

🔄 WHAT CHANGED

Emergency release in Oracle September 2026 Critical Patch Update with maximum CVSS 10.0 rating.

⚠️ WHY IT MATTERS

Complete bypass of JEP 290 deserialization filters via T3/IIOP network protocols, granting SYSTEM-level code execution without credentials.

🎯 WHO IS AFFECTED

WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 exposing ports 7001/7002 to internal networks or the internet.

Confidence rating: HIGH (95% — Official Oracle Advisory)
Explore Autopsy & Detection Rules →
CISA KEV / Webhost Targeting CVE-2026-87886 HTS 96/100
IMMEDIATE PATCH

Acronis Cyber Protect cPanel/Plesk — Symlink Race Condition to Root LPE →

🔄 WHAT CHANGED

CISA KEV addition confirming attackers leverage shared cPanel accounts to overwrite root system binaries.

⚠️ WHY IT MATTERS

Allows attackers with compromised low-privilege WordPress sites to immediately escape and seize root on dedicated hosting servers.

🎯 WHO IS AFFECTED

Web hosting providers and enterprises managing cPanel/Plesk servers with Acronis backup agents.

Confidence rating: HIGH (100% — KEV Confirmed)
Explore Autopsy & Detection Rules →
Agentic AI Security CVE-2026-90562 HTS 88/100 HASS 94/100
ACTIVE MITIGATION

LangBot AI Orchestrator — Password Reset Entropy Collapse & Agent Tool Hijacking →

🔄 WHAT CHANGED

Public exploit demonstrated brute-forcing 24-bit reset tokens due to async rate-limiting bypass.

⚠️ WHY IT MATTERS

Full admin takeover enabling attackers to weaponize agent tool connections, execute unauthorized shell commands, and poison vector memories.

🎯 WHO IS AFFECTED

Teams orchestrating autonomous AI agents with LangBot versions <= 3.2.1.

Confidence rating: HIGH (92% — Validated PoC)
Explore Autopsy & Detection Rules &rarr;
⚡ View Full Daily Changes Stream → 🕸️ Explore Knowledge Graph →

1. The Signal Reduction Funnel Methodology

Section titled “1. The Signal Reduction Funnel Methodology”

In a typical 24-hour cycle, global vulnerability databases, social feeds, and research trackers publish thousands of raw advisories. Security teams attempting to review everything experience operational paralysis:

THE SIGNAL REDUCTION FUNNEL
From raw telemetry (2,841 signals/24h) to decisive operational prioritization (9 actionable items)
1 Raw Ingestion
RAW SIGNALS
2,841 events / 24h
NVD, GitHub, arXiv, Vendor feeds, Social OSINT
-94.8% raw noise & non-material updates eliminated
2 Significant Changes
MATERIAL DELTAS
147 events / 24h
Version deltas, new PoC commits, CVSS score revisions
-84.4% filtered by prevalence and privilege requirements
3 High-Interest Events
QUALIFIED THREATS
23 events / 24h
Unauthenticated RCE, Enterprise tech stack, High deployment prevalence
-60.9% synthesized into operational directives
4 Actionable Decisions
IMMEDIATE ACTION REQUIRED
9 events / 24h
Weaponized exploits in wild, CISA KEV additions, Critical HTS ≥ 85
Operational Prescriptions Breakdown:
PATCH 4
ISOLATE 2
MITIGATE 2
MONITOR 1
  • Tier 1 (Raw Signals): Automated ingestion filters out duplicate advisories, documentation updates, and minor library bumps.
  • Tier 2 (Significant Changes): Evaluates if new material evidence (code diff, advisory addendum) alters the attack surface.
  • Tier 3 (High-Interest): Assesses attack vector, required privileges, and asset deployment footprint.
  • Tier 4 (Actionable Decisions): Synthesizes telemetry into one of 6 decisive actions: PATCH, MITIGATE, ISOLATE, REPLACE, ACCEPT, or MONITOR.

2. Cross-Workload Threat Trajectories

Section titled “2. Cross-Workload Threat Trajectories”
CISA KEV Integration Track actively exploited vulnerabilities mandated for federal and enterprise remediation.
Software Intelligence Catalog Analyze vulnerability exposure and dependency graphs across 108 enterprise products.
Agentic AI Threat Vectors Explore emerging attack patterns targeting autonomous multi-agent systems.
Hermes Threat Score (HTS) Understand the mathematical foundation of operational exploitability scoring.