CISA Adds Two Actively Exploited Vulnerabilities (CVE‑2026‑76460, CVE‑2026‑87886) to KEV Catalog
What It Is – The Cybersecurity and Infrastructure Security Agency (CISA) announced that two CVEs—CVE‑2026‑76460 (Cisco Identity Services Engine privileged‑API misuse) and CVE‑2026‑87886 (Acronis Backup default‑permission flaw)—have been confirmed as actively exploited and are now listed in the Known Exploited Vulnerabilities (KEV) Catalog.
Exploitability – Both vulnerabilities have documented evidence of real‑world exploitation; CISA’s inclusion in the KEV catalog signals that threat actors are already leveraging them. No public proof‑of‑concept is required for the advisory, but the active‑exploitation status elevates the risk profile.
Affected Products – Cisco Identity Services Engine (ISE) and Acronis Cyber Protect / Acronis Backup solutions.
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for a continuous, risk‑based patch‑management process that can surface high‑severity, exploited flaws before attackers gain foothold.
- Audit Evidence – Organizations must capture remediation evidence (patch dates, validation scans) to satisfy internal auditors and external regulators demanding a defensible remediation timeline.
- Supply‑Chain Resilience – Both products are often embedded in broader network or backup architectures; a lapse in remediation can cascade, undermining the trust posture of downstream services.
Recommended Actions
- Inventory all Cisco ISE and Acronis Backup instances across your environment.
- Verify current patch levels against the vendor‑released fixes for CVE‑2026‑76460 and CVE‑2026‑87886.
- Prioritize immediate remediation on any publicly exposed assets, documenting the process in your vulnerability‑management system.
- Conduct post‑remediation validation scans and retain logs as audit‑ready evidence.
- Review your risk‑based patch‑prioritization policy (e.g., aligning with CISA BOD 26‑04) to ensure future KEV additions are addressed promptly.
Source: CISA Advisory – Two Known Exploited Vulnerabilities Added to KEV Catalog (Sep 16 2026)