For federal civilian agencies, the KEV entries set a remediation deadline of September 19, 2026 under Binding Operational Directive 26-04. Private-sector administrators are not bound by that directive, but the practical message is clear: both vendors acknowledge active exploitation, and neither issue should wait for a normal monthly maintenance window.
Cisco’s advisory supplies the more alarming technical detail. CVE-2026-76460 affects Cisco ISE and Cisco ISE Passive Identity Connector, or ISE-PIC, regardless of device configuration. Cisco rates it CVSS 10.0 and says an unauthenticated remote attacker can send a crafted request to an affected API endpoint, bypass the web management interface’s authentication controls, and gain unauthorized access.
CISA’s KEV label calls the Cisco issue an “incorrect use of privileged APIs” vulnerability. Cisco’s own advisory describes the observed failure more directly as insufficient authentication on an API endpoint. Administrators should plan around Cisco’s operational description: this is an externally reachable management-plane authentication bypass, not a routine authenticated-administrator bug.
Cisco ISE administrators need to treat compromise assessment as part of patching
Cisco PSIRT says it is aware of active exploitation of CVE-2026-76460. More importantly, Cisco warns that successful exploitation may give an attacker command execution with root privileges, which means evidence on the appliance can be altered or removed after the fact.
That changes the response sequence. Installing the fixed patch is necessary, but it cannot be the last step for an exposed ISE deployment. Cisco specifically directs administrators to inspect the API gateway access logs for suspicious usernames, to perform that review on every node in a distributed deployment, and to check network and firewall logs outside the appliance for suspicious uploads or downloads. External telemetry matters here because an attacker with root-level control may be able to erase the appliance-side evidence defenders would normally trust.
Cisco says affected organizations that find signs of malicious activity should re-image affected nodes and restore configuration from backup where necessary. That is a stronger recovery recommendation than a simple service restart or credentials reset, and it reflects the level of access Cisco says an attacker may obtain.
The fixed releases are:
- Cisco ISE and ISE-PIC 3.1 require Patch 12.
- Cisco ISE and ISE-PIC 3.2 require Patch 11.
- Cisco ISE and ISE-PIC 3.3 require Patch 12.
- Cisco ISE and ISE-PIC 3.4 require Patch 7.
- Cisco ISE and ISE-PIC 3.5 require Patch 4.
Cisco ISE 3.0 is already out of software maintenance and has no listed patch path; organizations still operating it need to migrate to a supported release. This is the kind of legacy deployment that tends to escape patch compliance dashboards: the product is still performing an essential identity role, but the vendor’s remediation is no longer a small update.
Cisco says there is no workaround. It does, however, describe infrastructure access control lists as a temporary mitigation to limit management and control-plane traffic to only required sources. That distinction is important. Restricting who can reach ISE can reduce exposure while a change is scheduled, but it does not correct the vulnerable API endpoint and should not be recorded as completed remediation.
For Windows and enterprise administrators, ISE is often farther from the desktop than Active Directory or endpoint management tooling, but it can sit directly in the path of wired and wireless access decisions. A compromise of its management plane has a different operational consequence from a vulnerable endpoint application: it can give an intruder leverage over the system used to decide which users and devices get onto the network.
Acronis flaw is narrower, but shared hosting raises the stakes
CVE-2026-87886 concerns Acronis Backup integrations for cPanel & WHM and Plesk on Linux. The flaw is an insecure-permissions issue that can allow a low-privileged authenticated attacker to elevate privileges without user interaction.
Acronis says exploitation has been detected in limited, targeted attacks against its Backup plugin for cPanel & WHM. Reporting by BleepingComputer adds a material qualification: Acronis told the outlet that its exploitation assessment is based on a single report from a potentially affected customer. That does not weaken the need to patch—the vulnerability is now in CISA’s exploited catalog—but it does define what is known. There is no public evidence of broad indiscriminate exploitation, and Acronis has not publicly named an attacker, disclosed indicators of compromise, or explained what the intruders did after elevating privileges.
Help Net Security separately reported that Acronis had not identified active exploitation against the Plesk extension. The distinction matters for triage, but Plesk operators should not interpret it as an all-clear. The same CVE affects both product lines, and the absence of publicly reported exploitation is not proof that a deployment has not been targeted.
The affected versions are:
- Acronis Backup plugin for cPanel & WHM on Linux before build 1.9.3.1021; Acronis identifies version 1.9.3 HF3 as the fixed release.
- Acronis Backup extension for Plesk on Linux before build 1.8.11.638; Acronis identifies version 1.8.11 as the fixed release.
The technical threshold for exploitation is very different from the Cisco flaw. An attacker needs an existing low-privilege foothold on the vulnerable Linux system, rather than network access alone. Yet that constraint can be less comforting in hosting environments than it sounds. A shared server may have many customer, reseller, application, automation, or support accounts; a privilege boundary failure in backup software can turn one limited account into a broader server compromise.
Backup agents are particularly sensitive because they commonly need broad file-system access to protect websites, databases, mailboxes, and customer data. In a managed-hosting environment, the software’s operational purpose—reaching into many tenants’ data—also creates a valuable escalation target when local permissions are wrong.
Patch ownership may be unclear in managed services
The Acronis issue also exposes a common operational blind spot: the party paying for backup service is often not the party that controls the plugin version. A business might see an Acronis-branded backup feature in cPanel, while the hosting provider, managed service provider, or reseller owns the server image and extension lifecycle.
Windows-focused IT teams with externally hosted Linux workloads should therefore verify remediation rather than assume a provider has done it. Ask the host which Acronis integration is installed, whether the server runs cPanel & WHM or Plesk, the deployed build number, when the update was applied, and whether the provider performed any review for suspicious local privilege escalation. A generic confirmation that “backups are managed” does not answer any of those questions.
Administrators who directly manage the affected systems should patch first and then review how low-privilege access is granted. Accounts that can upload web content, run deployment jobs, use control-panel features, or access support automation deserve particular scrutiny because the vulnerability begins after a local foothold is established.
The KEV listing is a prioritization signal, not a complete incident report
CISA’s inclusion of these CVEs confirms that the agency has evidence meeting its active-exploitation threshold. It does not mean CISA has published a complete campaign narrative, detection package, attacker attribution, or full list of affected organizations.
That gap is especially visible in the Acronis case. Public reporting confirms limited targeted exploitation, but the publicly available record still lacks indicators of compromise and technical root-cause details. For Cisco, the vendor provides a more actionable starting point—log locations, network-log review guidance, and re-imaging advice when compromise is suspected—while also warning that root access can make local evidence unreliable.
The two entries should not receive identical treatment simply because they share a September 19 federal deadline. CVE-2026-76460 is the immediate emergency for organizations with reachable Cisco ISE or ISE-PIC management services: patch supported releases, restrict management-plane access during the change, and perform compromise assessment. CVE-2026-87886 is an urgent server-side update for operators of Acronis cPanel, WHM, and Plesk integrations, with special priority for shared and managed Linux infrastructure.
By the end of this week, the meaningful measure will not be whether both CVEs were added to a scanner’s watchlist. It will be whether exposed ISE nodes were upgraded and investigated, and whether every hosting provider running the affected Acronis components can identify the fixed build actually installed on its servers.