CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-76460, CVE-2026-87886)
CISA added two actively exploited vulnerabilities to the KEV Catalog: CVE-2026-76460 (Cisco ISE) and CVE-2026-87886 (Acronis Backup), requiring urgent remediation. Both vulnerabilities are confirmed as actively exploited in the wild. CVE-2026-76460 affects Cisco ISE via incorrect use of privileged APIs. CVE-2026-87886 affects Acronis Backup through incorrect default permissions. FCEB agencies must remediate per BOD 26-04.
Detection / Hunteropenrouter
Immediate Actions
- Patch Cisco ISE against CVE-2026-76460 on all exposed instances
- Patch Acronis Backup against CVE-2026-87886 on all installations
- Check for prior compromise before applying patches per BOD 26-04
- Restrict network access to Cisco ISE and Acronis Backup management interfaces
Key Takeaways
- BOD 26-04 mandates FCEB agencies remediate KEV-listed CVEs on publicly exposed assets
- CVE-2026-76460 involves incorrect use of privileged APIs in Cisco Identity Services Engine
- CVE-2026-87886 involves incorrect default permissions in Acronis Backup
- CISA encourages all organizations, not just federal agencies, to prioritize KEV remediation
- Agencies must check for prior system compromise before applying patches
Attack Chain
- Initial Access: Attacker exploits CVE-2026-76460 or CVE-2026-87886 on exposed Cisco ISE or Acronis Backup systems
- Privilege Escalation: Vulnerability grants elevated access via privileged APIs or incorrect default permissions
- Persistence: Attacker maintains access on compromised system post-exploitation
Affected Systems
- Cisco Identity Services Engine
- Acronis Backup
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-76460 | Cisco Identity Services Engine | Incorrect use of privileged APIs allows exploitation by malicious actors. | |
| CVE-2026-87886 | Acronis Backup | Incorrect default permissions enable unauthorized access or escalation. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Article provides no detection guidance, TTPs, or behavioral indicators. |
| Network Visibility | Low | No network indicators or C2 infrastructure described in the alert. |
| Detection Difficulty | Moderate | Requires identifying exposed assets and verifying patch status; no behavioral indicators provided. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unexpected privileged API calls on Cisco ISE appliances may indicate exploitation of CVE-2026-76460 (T1068). | Cisco ISE administrative and API logs | Privilege Escalation | Medium — legitimate API use may generate similar entries |
| Unauthorized permission changes or access on Acronis Backup systems may indicate exploitation of CVE-2026-87886 (T1068). | Acronis Backup audit and file permission logs | Privilege Escalation | Low — default permission changes are uncommon post-install |
Required Log Sources
- Vulnerability scanner output
- Asset inventory database
- Authentication logs for Cisco ISE
- Acronis Backup audit logs
Key Behavioral Indicators
- Privileged API activity on Cisco ISE from unexpected sources
- Permission modifications on Acronis Backup installations
- New administrative sessions to Cisco ISE from untrusted networks
Control Gaps
- Unpatched Cisco ISE instances exposed to network
- Acronis Backup installations retaining default permissions
- Lack of asset inventory for exposed backup infrastructure
False Positive Assessment
Low — KEV catalog entries are confirmed by CISA as actively exploited in the wild.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict network exposure of Cisco ISE and Acronis Backup consoles
- Review and correct default permissions on all Acronis installations
- Enforce network segmentation around identity and backup infrastructure
User Protection
- Ensure backup systems are not internet-facing
- Verify Cisco ISE deployments use least-privilege API access controls
MITRE ATT&CK Mapping
Privilege Escalation
Lateral Movement
Plain-Language Summary
CISA added two security flaws to its list of known exploited vulnerabilities. One affects Cisco Identity Services Engine and the other affects Acronis Backup. Both are being actively used by attackers. Organizations should patch affected systems and check for signs of prior compromise.
- cveCVE-2026-76460Incorrect use of privileged APIs allows exploitation by malicious actors.
- cveCVE-2026-87886Incorrect default permissions enable unauthorized access or escalation.