CISA 2026-09-16

CISA KEV — Cisco Identity Services Engine (CVE-2026-76460) +1 more

Machine-generated analysis · WAYSCloud LLM

Cisco Identity Services Engine and Acronis Backup have been added to CISA’s Known Exploited Vulnerabilities catalog.

Context

The advisory lists Cisco Identity Services Engine and Acronis Backup as the affected products. Both CVE-2026-76460 and CVE-2026-87886 are described as actively exploited and therefore high-risk for publicly exposed assets. The notice cites BOD 26-04, which directs agencies to prioritize rapid remediation of KEV items that grant total control after exploitation.

Operator considerations

Check: inventory all Cisco Identity Services Engine and Acronis Backup deployments.
Isolate: segment any publicly reachable instances until a fix is applied.
Patch: apply vendor-provided updates or mitigations for CVE-2026-76460 and CVE-2026-87886 as soon as they are available.
Log: monitor logs for attempts to use privileged APIs on ISE or for unauthorized access to Acronis Backup files.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on p...

Read the full advisory on CISA →