Cisco is dealing with a maximum-severity zero-day in its Identity Services Engine (ISE) platform after CISA confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2026-76460, stems from incorrect use of privileged APIs within ISE and received a rare 10.0 out of 10 CVSS score, the highest possible rating.

The bug allows attackers to bypass authentication controls entirely, effectively granting access to functions and data that should require verified credentials. Because ISE is widely deployed as a network access control and policy enforcement layer, exploitation of an authentication bypass at this level can give attackers a foothold to manipulate network access decisions across an organization.

Second Flaw Added to KEV Catalog

CISA’s September 16, 2026 alert also added CVE-2026-87886, an incorrect default permissions vulnerability in Acronis Backup, to the KEV Catalog. Both vulnerabilities were added based on confirmed evidence of active exploitation, meeting CISA’s bar for inclusion: a valid CVE identifier, proof of in-the-wild attacks, and available mitigation guidance.

What Agencies Must Do

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize remediation of KEV Catalog entries, particularly those on internet-facing assets that could grant an attacker full control post-exploitation. The directive also requires agencies to determine whether systems were compromised before patches were applied, not just after.

While BOD 26-04 legally binds only federal agencies, CISA is urging all organizations, public and private, to treat KEV Catalog additions as top-priority patching events and adopt the same risk-based vulnerability management approach.

Why It Matters

Authentication bypass flaws in identity and access management infrastructure are especially dangerous because they undermine the trust boundary that other security controls rely on. Security teams running Cisco ISE should treat this as an urgent priority:

  • Confirm which ISE versions are affected and apply vendor patches or mitigations without delay
  • Review privileged API access logs for signs of prior exploitation
  • Audit Acronis Backup deployments for default permission misconfigurations tied to CVE-2026-87886
  • Assume compromise checks are needed for any internet-exposed instances predating remediation