In 30 seconds
- CISA added CVE-2026-85706 to the KEV catalogue on 11 September. If you run the affected product, treat this as urgent because it is being exploited in the wild.
- Cisco has warned that a max severity Identity Services Engine (ISE) zero-day is being exploited. If ISE sits in your access control stack, this is a high impact path to privilege and network control.
- Jersey Cyber Security Centre has published guidance on AI-enabled security risks. The practical takeaway is governance, data controls, and supplier checks, not panic.
Why it matters
Regulated Channel Islands organisations do not get to choose where risk shows up. It lands in core identity, remote access, and the finance and data flows that keep the business running. This week is about closing the obvious doors, fast.
CVE-2026-85706: the KEV signal
KEV is a weekly signal of what attackers are actively using right now, and it is one of the easiest things to justify to boards and auditors as a patch priority. CISA added CVE-2026-85706 to the Known Exploited Vulnerabilities catalogue on 11 September. That means exploitation is confirmed, not theoretical. If the affected product is in your estate, especially anything internet-facing, patch or mitigate immediately and then validate the fix took effect. The organisations that handle this well are the ones where someone owns each system, someone owns each patch decision, and someone can prove what happened afterwards. Evidence, not intent.
Cisco ISE: when identity infrastructure becomes the target
Identity platforms like Cisco ISE are high leverage targets. ISE controls who and what gets access to your network. If it is compromised, the attacker can often move quickly across the environment, escalate privileges, and establish persistence in ways that are difficult to detect without good logging and segmentation. That turns a technical issue into a business continuity and regulatory reporting problem.
If you run Cisco ISE anywhere, including at key suppliers or managed service providers, confirm patch status immediately. Confirm who has admin access. Confirm you have alerting for unusual logins and configuration changes. If ISE is not in your environment, this is still a prompt to ask the same questions about whatever identity platform you do rely on, because the attack pattern is the same.
AI risk: governance, not panic
AI risk is now a mainstream operational topic. Jersey Cyber Security Centre has published guidance on AI-enabled security risks, and the practical message is clear. The organisations that do best are the ones that set clear rules for what staff can use, what data can be shared, and how suppliers are assessed. You do not need to ban AI. You need to govern it.
For most Channel Islands firms, the near-term risk is not a rogue model. It is sensitive client data being pasted into an external AI tool by someone trying to be productive. A simple, plain English policy that says what is allowed, what is not, and where to go with questions is more effective than a 40-page framework nobody reads.
Questions to ask your team this week
- 1.Do we have a named owner who checks KEV weekly, confirms whether we are exposed, and records patch or mitigation evidence?
- 2.Do we run Cisco ISE anywhere, including at key suppliers, and do we have a rapid patch and rollback plan for it?
- 3.If an identity platform was compromised, how quickly could we detect it and contain it, and who makes the call on regulator and customer communications?
- 4.What is our current policy on staff use of AI tools, and do we have a simple way to prevent sensitive data being pasted into external services?
One thing to do this week
Run a 60-minute "identity and access" fire drill. Confirm whether you run Cisco ISE, confirm who patches it, check exposure, and document the patch status. In the same session, do a quick KEV sweep for CVE-2026-85706 and capture evidence of action taken.
Sources
- CISA, "CISA Adds One Known Exploited Vulnerability to Catalog" (11 September 2026):
cisa.gov - BleepingComputer, "Cisco warns of max severity ISE zero-day exploited in attacks":
bleepingcomputer.com - Jersey Cyber Security Centre, "AI-enabled security risks: guidance for organisations":
jerseycsc.org