No Rest in 2026 as Patch Alerts Amass for Cisco, HPE and n8n

New year, new vulnerabilities. It hasn’t taken long for a burst of exploitable flaws to pop into view and send system administrators scrambling after emergency security fixes and advisories.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

It’s less than 10 days in 2026 and Cisco released software updates to patch a zero-day flaw that can be exploited in its next-generation security platform to steal sensitive data.

Separately, cybersecurity officials warned that attackers are actively exploiting a flaw in Hewlett Packard Enterprise’s widely used IT infrastructure management software OneView to remotely execute code and compromise the software.

Following a patch for a serious flaw in popular, artificial-intelligence-enabled n8n automation software, security experts warned that two different types of “Ni8mare” proof-of-concept exploits have appeared, likely presaging widespread hack attacks against the 100,000 servers on which the open-source software is installed.

Cisco Patches ISE

Cisco published an alert on Wednesday about a newly patched flaw in its network access control platform.

“A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information,” says the security advisory.

Tracked as CVE-2026-20029, “this vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC” and can be exploited “by uploading a malicious file to the application,” according to the advisory.

The technology giant said the vulnerability doesn’t exist in ISE version 3.5, released in September 2025, but does exist in every previous release of ISE and ISE-PIC, regardless of how they’re configured.

“A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators,” it said.

The vulnerability has been assigned a “medium” CVSS score of 4.9 out of 10, reflecting that an attacker would need to possess administrator-level privileges to exploit the flaw.

The flaw could be exploited if attackers steal administrator credentials, or by malicious insiders. This would pose an elevated security risk to an organization given what the platform is meant to safeguard. “Cisco Identity Services Engine is a network security system that helps ensure that only trusted users and devices can access resources on a network,” and enforces policies tied to both “endpoint access control and network device administration,” said cybersecurity firm Qualys.

While no active exploits have yet been reported in the wild, the product security incident response team at Cisco said that it “is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.”

The company’s Wednesday security updates comprise patches for ISE and ISE-PIC releases 3.2, 3.3 and 3.4. The latest version, 3.5, released in September 2025, is not vulnerable. The company said versions earlier than 3.2 are vulnerable and will not be patched, meaning customers still using those versions must “migrate to a fixed release.”

The company said no workarounds or mitigations exist to patch the flaw, except to install a fixed version.

Cisco’s widely used network access control product is available as both a physical and virtual appliance, and works across numerous on-premises and cloud platforms, including VMware ESXi, KVM on Red Hat, Microsoft Hyper-V, Amazon Web Services, Azure Web Services, Red Hat OpenShift, Nutanix AHV and VMware Cloud.

Cisco’s ISE platform has been a repeat target for attackers. Cybercrime and nation-state groups continue to focus on exploiting edge infrastructure to gain initial access to a victim’s environment.

HPE OneView Being Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency on Wednesday warned that a vulnerability in HPE OneView is being actively exploited by attackers. Tracked as CVE-2025-37164, the vulnerability has a maximum severity CVSS rating of 10, and exists in every version of the software prior to version 11.00.

“This vulnerability could be exploited, allowing a remote unauthenticated user to perform remote code execution,” warns HPE’s security advisory.

HPE patched the flaw on Dec. 17, 2025, before publishing updated security hot fixes the next day. These fixes are available for every version of HPE OneView from 5.20 through version 10.20.

CISA added the flaw to its catalog of Known Exploited Vulnerabilities on Wednesday, setting a deadline of Jan. 28 for federal civilian agencies to patch the flaw, apply mitigations or temporarily discontinue using affected software.

n8n Exploit Code Published

Users of open-source n8n software, which is used to create “low code,” self-hostable automation platforms that offer AI capabilities, are being urged to ensure they’ve upgraded to the latest version, which fixes a serious vulnerability.

Security firm Cyera, which discovered and reported the flaw directly to n8n on Nov. 9, 2025, has dubbed it “Ni8mare,” because it “enables attackers to take over locally deployed instances, impacting an estimated 100,000 servers globally.”

On Wednesday, the team behind n8n said in a security alert that the latest 1.121.0 version of the software, released on Nov. 18, 2025, includes a fix for a critical vulnerability that an attacker could exploit to grab files, without having to first authenticate.

The vulnerability, which exists in every prior version of the software, “could result in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage,” the alert warns.

Tracked as CVE-2026-21858, the flaw has been assigned the maximum, critical CVSS rating of 10.

Attackers can exploit it to remotely exploit code and take control of a locally deployed instance. “By exploiting this flaw, an attacker can overwrite an internal JSON object to read arbitrary files from the server. This capability may be leveraged to forge an administrator session token and exploit subsequent authenticated vulnerabilities for code execution,” said cybersecurity firm Rapid7.

The n8n team said that short of patching, no alternative, permanent workarounds are available, although “users may restrict or disable publicly accessible webhook and form endpoints until upgrading” as a temporary mitigation.

The risk posed by vulnerability is widespread, since “n8n is the go-to platform for building automated workflows in the age of AI and AI agents,” Cyera said.

“With over 100 million Docker pulls, millions of users and thousands of enterprises using it, n8n has become the central nervous system of automation infrastructure, and there’s a good chance your organization uses it too,” it said.

The risk posed by the vulnerability hinges on the extent to which any given organization has tied n8n automation workflows to its enterprise software, such as Google Drive, Salesforce customer data, identity and access management systems, customer databases, code development pipelines, or API keys for its OpenAI or other cloud-based services.

“Imagine a large enterprise with 10,000+ employees with one n8n server that anyone uses. A compromised n8n instance doesn’t just mean losing one system –  it means handing attackers the keys to everything,” thus potentially becoming ” a single point of failure and a goldmine for threat actors,” it said.

In a full technical write-up of the flaw published Wednesday, including a proof-of-concept exploit, Cyera urged all users to update to the latest version. It also recommends ensuring the software remains as locked down as possible, by never exposing n8n to the internet “unless absolutely necessary,” as well as by requiring “authentication for all forms you create.”

Separately on Wednesday, third-party security researcher Valentin Lobstein published a proof-of-concept exploit for the vulnerability. Instead of just exploiting CVE-2026-21858, aka Ni8mare, Lobstein’s exploit also targets a separate, also patched flaw with a CVSS rating of 10, tracked as CVE-2025-68613. The flaw “allows authenticated users to execute arbitrary system commands through crafted expressions in workflow parameters,” Rapid7 said.

Other recently discovered vulnerabilities that exist in n8n versions prior to the latest release might also be targeted or chained together to facilitate a Ni8mare-style attack, Rapid7 said.