CISA KEV Catalog Addition: Active Exploitation of Cisco ISE Authentication Bypass (CVE-2026-76460) and Acronis Backup Privilege Escalation (CVE-2026-87886)

Key facts for Cisco ISE Acronis KEV addition

Detection coverage for Cisco ISE Acronis KEV addition

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2542 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cisco ISE Unauthenticated API Gateway Auth-Bypass Exploitation (CVE-2026-76460)

Detects exploitation of CVE-2026-76460, an unauthenticated API auth-bypass in Cisco ISE/ISE-PIC's API gateway (behind ISE-Kong) that grants root-level command execution. Flags API requests without a valid Authorization header and any occurrence of the 'dummyuser' account Cisco's advisory instructs defenders to hunt for in the API gateway access log.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078.001, T1059
• Data sources: cisco_ise_apigateway_access_log, cisco_ise_syslog, network_ids
• Severity: critical
• Confidence: high

Splunk SPL

```comment("CVE-2026-76460: Cisco ISE/ISE-PIC unauthenticated API gateway auth-bypass -> root command execution. Hunts requests to the ISE-Kong API gateway lacking an auth header, and creation/use of the 'dummyuser' account Cisco's advisory flags as the exploitation indicator.")```
index=network sourcetype="cisco:ise:apigateway"
| rex field=_raw "(?<http_method>GET|POST|PUT|DELETE)\s+(?<uri_path>/\S+)\s+HTTP"
| eval has_auth_header=if(match(_raw, "(?i)authorization:\s*(bearer|basic)"), 1, 0)
| eval dummyuser_flag=if(match(_raw, "(?i)\bdummyuser\b"), 1, 0)
| where has_auth_header=0 OR dummyuser_flag=1
| stats count as req_count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints_hit dc(uri_path) as distinct_endpoints values(src_ip) as src_ips by dest_ip dummyuser_flag
| where req_count > 3 OR dummyuser_flag=1
| eval severity=if(dummyuser_flag=1, "critical", "high")
| table first_seen last_seen dest_ip src_ips endpoints_hit req_count dummyuser_flag severity

Microsoft KQL

// CVE-2026-76460: Cisco ISE/ISE-PIC unauthenticated API gateway auth-bypass hunting query
// Detects requests to the ISE-Kong API gateway lacking an Authorization header, and any occurrence of the 'dummyuser' account Cisco's advisory flags as the compromise indicator.
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Cisco" and DeviceProduct has "ISE"
| where RequestURL has "/api"
| extend HasAuthHeader = AdditionalExtensions has_any ("Authorization: Bearer", "Authorization: Basic")
| extend DummyUserFlag = (RequestURL has "dummyuser") or (Message has "dummyuser") or (SourceUserName == "dummyuser")
| where HasAuthHeader == false or DummyUserFlag == true
| summarize RequestCount=count(), DistinctURLs=make_set(RequestURL), SourceIPs=make_set(SourceIP) by DestinationHostName, DummyUserFlag, bin(TimeGenerated, 1h)
| where RequestCount > 3 or DummyUserFlag == true
| project TimeGenerated, DestinationHostName, DummyUserFlag, RequestCount, DistinctURLs, SourceIPs

Sigma

title: Cisco ISE Unauthenticated API Gateway Auth-Bypass (CVE-2026-76460)
id: 8f3c2b1a-4d6e-4a2f-9b7c-1e5f3a9c7d21
status: experimental
description: Detects unauthenticated requests to the Cisco ISE/ISE-PIC API gateway (behind ISE-Kong) and use of the 'dummyuser' account, consistent with exploitation of CVE-2026-76460 (CVSS 10.0, CWE-648) granting root-level command execution.
references:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
    - https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1078.001
    - attack.execution
    - attack.t1059
    - cve.2026.76460
logsource:
    category: application
    product: cisco
    service: ise
detection:
    selection_api:
        RequestURL|contains: '/api'
    filter_authheader:
        AuthorizationHeader|contains:
            - 'Bearer'
            - 'Basic'
    selection_dummyuser:
        User: 'dummyuser'
    condition: (selection_api and not filter_authheader) or selection_dummyuser
falsepositives:
    - Legitimate integrations or monitoring tools polling the ISE API using a non-standard auth header scheme
    - Internal vulnerability scanners probing the ISE management interface
level: critical

Known false positives:

• Legitimate automated integrations or monitoring tools polling the ISE API without the expected Authorization header if API-key auth is configured differently
• Scheduled internal vulnerability scanners probing the ISE management interface

Tuning notes: Tune the auth-header detection logic to the organization's actual ISE API authentication scheme (e.g. custom API-key header name) to avoid false positives from legitimate integrations, and whitelist known scanner/monitoring source IPs.

• 🔒 Cisco ISE Unauthenticated API Gateway Auth-Bypass Exploitation (CVE-2026-76460) · unlock with TL Creds
• 🔒 Acronis Backup Plugin Insecure-Permission Local Privilege Escalation (CVE-2026-87886) · unlock with TL Creds
• 🔒 Post-Compromise Evidence Tampering and Backup Recovery Sabotage · unlock with TL Creds
• 🔒 Cisco ISE Unauthenticated API Gateway Auth-Bypass Exploitation (CVE-2026-76460) · unlock with TL Creds
• 🔒 Acronis Backup Plugin Insecure-Permission Local Privilege Escalation (CVE-2026-87886) · unlock with TL Creds
• 🔒 Post-Compromise Evidence Tampering and Backup Recovery Sabotage · unlock with TL Creds
• 🔒 Acronis Backup Plugin Insecure-Permission Local Privilege Escalation (CVE-2026-87886) · unlock with TL Creds
• 🔒 Post-Compromise Evidence Tampering and Backup Recovery Sabotage · unlock with TL Creds

Indicators of compromise for Cisco ISE Acronis KEV addition

As of 2026-09-18, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2542.

How Cisco ISE Acronis KEV addition works

Both carry a BOD 26-04 federal remediation deadline of 2026-09-19.

On September 16, 2026, CISA added CVE-2026-76460 and CVE-2026-87886 to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed evidence of active, in-the-wild exploitation, triggering a Binding Operational Directive 26-04 remediation deadline of September 19, 2026 for Federal Civilian Executive Branch agencies, who must also check publicly exposed instances for prior compromise.

CVE-2026-76460 (CWE-648, Incorrect Use of Privileged APIs) affects Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) releases 3.1 through 3.5 (and unsupported 3.0), plus ISE-PIC 3.4.0/3.5.0. Per Cisco's advisory (cisco-sa-ISE-ABP-VNSW7Tn5) and its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), insufficient authentication control on an API endpoint behind the ISE-Kong API gateway lets an unauthenticated, remote attacker with no prerequisites send a crafted request to bypass the web-based management interface entirely and execute commands with root privileges. Cisco PSIRT confirmed active exploitation and noted attackers can erase log entries to conceal their actions; defenders are told to hunt for a 'dummyuser' account in the API gateway access log (`./ise/logs/apigateway/access.log..gz` when extracted from a support bundle) and to cross-check external network/firewall logs for unexpected data transfers as a secondary compromise indicator. Cisco disclosed that CVE-2026-76460 was identified while resolving a Technical Assistance Center (TAC) support case, confirming at least one enterprise environment was already compromised before the vulnerability was publicly reported. No workaround exists beyond infrastructure ACLs restricting management-plane access — patching (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4) is mandatory. Because ISE is the Network Access Control (NAC) platform enforcing 802.1X authentication, device profiling, and posture assessment across wired, wireless, and VPN connections, compromise of an exposed instance can cascade into broader network-wide access-control failure; media reporting noted the CVE was disclosed alongside other, separately tracked Cisco ISE security advisories published the same day, underscoring identity infrastructure as an expanding attack surface (out of scope for this threat record beyond that context).

CVE-2026-87886 (CWE-276, Incorrect Default Permissions, CVSS 3.1 base score 7.8) affects the Acronis Backup plugin for cPanel & WHM (builds before 1.9.3.1021, fixed in 1.9.3 HF3) and the Acronis Backup extension for Plesk (builds before 1.8.11.638, fixed in 1.8.11). Insecure default file permissions on the Linux-based backup component allow an authenticated, low-privileged local attacker to escalate privileges without user interaction and without any special conditions beyond the attacker's control (low attack complexity). Acronis confirmed exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments — based on a single customer report — while Plesk deployments have not been observed exploited; the company withheld technical root-cause and post-escalation attacker-behavior detail specifically to give administrators a patching window before publishing more. Reporting describes a plausible multi-stage chain — initial access via a compromised hosting account, weak credentials, a vulnerable web application, or a web shell, followed by abuse of the vulnerable Acronis component to escalate privileges — with impact in shared-hosting/MSP environments potentially extending to other customers' backup data, system files, and control-panel resources on the same host; because the vulnerable component is itself backup software, a root/administrative foothold gained through it can also be leveraged to delete, corrupt, or disable backup jobs and recovery points, inhibiting incident recovery for affected tenants.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078.001 Default Accounts; T1078.003 Valid Accounts; T1098 Account Manipulation; T1136.001 Create Account; T1505.003 Web Shell

defense-impairment

T1222.002 Linux and Mac Permissions; T1685.006 Clear Linux or Mac System Logs

Impact

T1490 Inhibit System Recovery; T1565 Data Manipulation

Credential Access

T1552 Unsecured Credentials

Defense Evasion

T1562 Impair Defenses

Reconnaissance

T1595 Active Scanning

Remediation for Cisco ISE Acronis KEV addition

Patches

• Cisco ISE/ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4
• Acronis Backup plugin for cPanel & WHM 1.9.3 HF3
• Acronis Backup extension for Plesk 1.8.11

Immediate actions

• Apply Cisco ISE/ISE-PIC patches (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4) or take internet-exposed management interfaces offline per the BOD 26-04 2026-09-19 deadline
• Upgrade Acronis Backup plugin for cPanel & WHM to 1.9.3 HF3 and Acronis Backup extension for Plesk to 1.8.11 immediately on all Linux hosts
• Review Cisco ISE access.log for the 'dummyuser' account and any other unrecognized local accounts or evidence of log tampering
• Audit Acronis-related files/directories, authentication logs, shell activity, and cPanel/Plesk account events for unauthorized privilege changes

Workarounds

• No official workaround for CVE-2026-76460; infrastructure ACLs limiting management-plane traffic only reduce exposure
• No official workaround for CVE-2026-87886; installing the patched build is the only vendor-confirmed remediation

Longer-term hardening

• Restrict management-plane access to Cisco ISE with infrastructure ACLs, since no vendor workaround exists for CVE-2026-76460
• Migrate any remaining Cisco ISE 3.0 (end-of-support) deployments to a currently patched release train
• Harden default file/directory permissions on backup and hosting-control-panel components to close CWE-276-class weaknesses
• Adopt continuous KEV-catalog monitoring and risk-based vulnerability management consistent with BOD 26-04
• Per the CISA KEV catalog required action, apply vendor mitigations per BOD 26-04 guidance and discontinue use of the affected product if mitigations are unavailable
• Verify integrity and availability of backup jobs/recovery points on any host running the vulnerable Acronis component, given a root foothold gained through it could be used to inhibit recovery

Affected and fixed versions

• Cisco — Identity Services Engine (ISE) / ISE Passive Identity Connector (ISE-PIC)
  Vulnerable versions: 3.0 (end of support); 3.1 through 3.1 Patch 11; 3.2 through 3.2 Patch 10; 3.3 through 3.3 Patch 11; 3.4 through 3.4 Patch 6; 3.5 through 3.5 Patch 3
  Fixed in: 3.1 Patch 12; 3.2 Patch 11; 3.3 Patch 12; 3.4 Patch 7; 3.5 Patch 4
• Acronis — Backup plugin for cPanel & WHM
  Vulnerable versions: builds before 1.9.3.1021
  Fixed in: 1.9.3 HF3
• Acronis — Backup extension for Plesk
  Vulnerable versions: builds before 1.8.11.638
  Fixed in: 1.8.11

Timeline of Cisco ISE Acronis KEV addition

Last updated 2026-09-18 · revalidated 1× · latest source

• 2026-09-09 Acronis ships patched builds (Backup plugin for cPanel & WHM 1.9.3 HF3; Backup extension for Plesk 1.8.11) ahead of public disclosure of CVE-2026-87886.
• 2026-09-16 Cisco publishes a companion 'Identity Services Engine Hardening Release: September 2026' advisory (cisco-sa-hardening-ise-XU5EwX5T) the same day, patching six additional critical/high-severity ISE and ISE-PIC vulnerabilities (CVE-2026-20130, CVE-2026-20192, CVE-2026-20194, CVE-2026-20234, CVE-2026-20237, CVE-2026-20287); these are tracked separately and none carries confirmed active-exploitation status.
• 2026-09-16 Security media (BleepingComputer, SecurityWeek, Help Net Security, Cyberpress, SecurityOnline) report on both vulnerabilities and the KEV catalog addition.
• 2026-09-16 CISA's alert invokes Binding Operational Directive 26-04, directing FCEB agencies to prioritize remediation on publicly exposed assets and check for prior compromise.
• 2026-09-16 CISA adds both CVE-2026-76460 and CVE-2026-87886 to the Known Exploited Vulnerabilities catalog based on confirmed evidence of active exploitation.
• 2026-09-16 Cisco publishes advisory cisco-sa-ISE-ABP-VNSW7Tn5 for CVE-2026-76460 (CVSS 10.0, CWE-648), with PSIRT confirming active exploitation enabling unauthenticated root-level command execution on ISE.
• 2026-09-16 Acronis publishes advisory SEC-10986 disclosing CVE-2026-87886 (CVSS 7.8, CWE-276) and confirms limited, targeted in-the-wild exploitation against cPanel & WHM deployments; Plesk not observed exploited.
• 2026-09-16 Cisco discloses that CVE-2026-76460 was identified during resolution of a Technical Assistance Center (TAC) support case, confirming at least one enterprise ISE environment was already compromised before the vulnerability was publicly reported.
• 2026-09-19 BOD 26-04 remediation deadline: Federal Civilian Executive Branch agencies must have patched or mitigated both CVE-2026-76460 and CVE-2026-87886.

Update history

• 2026-09-18 — CVE-2026-76460: Critical Cisco ISE/ISE-PIC Authentication Bypass Actively Exploited as a Zero-Day (CVSS 10.0): What changed No field escalation — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), and attribution (LOW/Unknown) are unchanged. The new report deepens the CVE-2026-76460 half of this record: explicit zero-day framing (exploit

Sources cited for Cisco ISE Acronis KEV addition

• CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA · Advisory · 2026-09-16
• CISA Known Exploited Vulnerabilities Catalog (JSON feed) CISA · Government advisory · 2026-09-16
• NVD - CVE-2026-76460 Detail NVD (NIST) · Government advisory · 2026-09-16
• Cisco Security Advisory: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5) Cisco · Vendor report · 2026-09-16
• Acronis Advisory: Local privilege escalation due to insecure file permissions (SEC-10986) security-advisory.acronis.com · Vendor report · 2026-09-16
• CVE-2026-76460: Cisco Identity Services Engine Software vulnerability profile strix.ai · Research · 2026-09-16
• The Gatekeeper Is the Door: Cisco ISE's Nine-CVE Disclosure and the Identity Infrastructure Attack Surface forkast.news · Research · 2026-09-16
• Acronis warns of actively exploited flaw in its cPanel backup plugin BleepingComputer · News · 2026-09-16
• Acronis Patches Exploited Vulnerability in cPanel Backup Plugin SecurityWeek · News · 2026-09-16
• Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886) Help Net Security · News · 2026-09-16
• Acronis Backup Plugin Vulnerability in cPanel and Plesk Exploited in the Wild cyberpress.org · News · 2026-09-16
• CVE-2026-76460 (CVSS 10): Cisco ISE Vulnerability Exploited in the Wild securityonline.info · News · 2026-09-16

More in vulnerability

• TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released
• Active Exploitation of BTCPay Server Instances Draining Bitcoin Hot Wallets (Versions Older Than 2.4.2)
• Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)
• Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)
• Microsoft Edge Logic-Bug Full Exploit Chain Enables Code Execution Without Memory Corruption (Pwn2Own Berlin 2026, Orange Tsai; CVE-2026-45495)