CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The most identity-relevant is CVE-2026-76460, an incorrect use of privileged APIs in Cisco Identity Services Engine (ISE). The second, CVE-2026-87886, is an incorrect default permissions flaw in Acronis Backup.
The Cisco ISE flaw is notable for identity teams because ISE is a core network access control and authentication platform, frequently integrated with Active Directory and RADIUS/802.1X policy enforcement. A privileged API weakness could let attackers escalate privileges or manipulate access policies, undermining the very system that governs who and what connects to the network.
Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed flaws on exposed, high-impact assets and check whether compromise occurred before patching. What to take away: organizations running Cisco ISE should patch immediately and audit for signs of privileged API abuse, since a compromised access-control platform can cascade across the entire identity fabric.