CISA KEV adds Cisco ISE and Acronis Backup flaws: what defenders should patch first

On 16 September 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-76460 in Cisco Identity Services Engine and CVE-2026-87886 in Acronis Backup. CISA's alert points federal agencies to BOD 26-04 and urges everyone else to adopt risk-based vulnerability management and prioritise KEV entries.

Cisco ISE: authentication bypass on a control-plane system

CISA labels CVE-2026-76460 "Incorrect Use of Privileged APIs". Help Net Security's coverage describes it as an authentication bypass caused by insufficient authentication control on an API endpoint. An unauthenticated attacker can send a crafted request and gain unauthorised access by bypassing the web-based management interface.

Cisco ISE and the ISE Passive Identity Connector (ISE-PIC) releases 3.0 through 3.5 are affected. The reported fixed releases are:

• 3.1 Patch 12
• 3.2 Patch 11
• 3.3 Patch 12
• 3.4 Patch 7
• 3.5 Patch 4

That coverage lists no fixed patch for the 3.0 train, so confirm your upgrade path in Cisco's own advisory. It also reports that there is no workaround.

ISE decides who and what gets onto the network, so a compromised management plane affects far more than one server. The same coverage says attackers may delete the product's logs. Cisco's advice is to check access logs for suspicious usernames and to cross-reference network and firewall logs for unexpected uploads to external IPs or downloads from malicious sources. Treat log gaps on an ISE node as a finding in their own right.

Acronis Backup: local privilege escalation on hosting servers

CVE-2026-87886 is an incorrect-default-permissions flaw (CWE-276) rated CVSS 7.8. The Hacker News reports that it allows local privilege escalation on Linux through insecure file permissions. Affected versions include the Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021 and the Acronis Backup extension for Plesk. Exploitation was detected "in limited, targeted attacks", and Acronis said the update "should be installed immediately by all users". The article gives no details on who is exploiting it.

Because the flaw is local, the attacker needs a foothold first. Our reading is that on shared or multi-tenant hosting servers, where many low-privileged accounts share one machine, the step from a compromised customer application to root is a realistic chain. Backup agents usually run with high privilege and touch sensitive data, so a permissions error there matters more than its CVSS score suggests.

How to prioritise

1. 1Inventory first. Find every ISE and ISE-PIC node and every cPanel/Plesk host running the Acronis plugin. Both are easy to forget in asset registers.
2. 2Patch ISE ahead of the Acronis plugin. An unauthenticated remote bypass with no workaround outranks a local privilege escalation. Apply both quickly.
3. 3Restrict management access. Keep ISE administration off untrusted networks while you patch. This reduces exposure but is not a fix.
4. 4Hunt as well as patch. Because exploitation is confirmed, review logs from before the patch date. A patched box may already have been accessed.

Coverage of the Acronis entry reports a federal remediation deadline of 19 September 2026. Private-sector teams have no formal deadline, but adversaries are already using both flaws, so aligning with that schedule is a sensible baseline.