# CISA KEV Catalog Addition: Active Exploitation of Cisco ISE Authentication Bypass (CVE-2026-76460) and Acronis Backup Privilege Escalation (CVE-2026-87886)

> CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-09-16: CVE-2026-76460, a CVSS 10.0 unauthenticated API authentication-bypass flaw in Cisco Identity Services Engine (ISE) and ISE-PIC granting root-level command execution, and CVE-2026-87886, a CVSS 7.8 insecure-file-permissions flaw in the Acronis Backup plugin for cPanel & WHM and Plesk enabling local privilege escalation on shared-hosting and MSP Linux servers. Both carry a BOD 26-04 federal remediation deadline of 2026-09-19.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-18T12:06:59.811Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2542
- **ID:** TL-2026-2542
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76460, CVE-2026-87886

## Description

On September 16, 2026, CISA added CVE-2026-76460 and CVE-2026-87886 to its Known Exploited Vulnerabilities (KEV) catalog based on confirmed evidence of active, in-the-wild exploitation, triggering a Binding Operational Directive 26-04 remediation deadline of September 19, 2026 for Federal Civilian Executive Branch agencies, who must also check publicly exposed instances for prior compromise.

CVE-2026-76460 (CWE-648, Incorrect Use of Privileged APIs) affects Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) releases 3.1 through 3.5 (and unsupported 3.0), plus ISE-PIC 3.4.0/3.5.0. Per Cisco's advisory (cisco-sa-ISE-ABP-VNSW7Tn5) and its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), insufficient authentication control on an API endpoint behind the ISE-Kong API gateway lets an unauthenticated, remote attacker with no prerequisites send a crafted request to bypass the web-based management interface entirely and execute commands with root privileges. Cisco PSIRT confirmed active exploitation and noted attackers can erase log entries to conceal their actions; defenders are told to hunt for a 'dummyuser' account in the API gateway access log (`./ise/logs/apigateway/access.log..gz` when extracted from a support bundle) and to cross-check external network/firewall logs for unexpected data transfers as a secondary compromise indicator. Cisco disclosed that CVE-2026-76460 was identified while resolving a Technical Assistance Center (TAC) support case, confirming at least one enterprise environment was already compromised before the vulnerability was publicly reported. No workaround exists beyond infrastructure ACLs restricting management-plane access — patching (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4) is mandatory. Because ISE is the Network Access Control (NAC) platform enforcing 802.1X authentication, device profiling, and posture assessment across wired, wireless, and VPN connections, compromise of an exposed instance can cascade into broader network-wide access-control failure; media reporting noted the CVE was disclosed alongside other, separately tracked Cisco ISE security advisories published the same day, underscoring identity infrastructure as an expanding attack surface (out of scope for this threat record beyond that context).

CVE-2026-87886 (CWE-276, Incorrect Default Permissions, CVSS 3.1 base score 7.8) affects the Acronis Backup plugin for cPanel & WHM (builds before 1.9.3.1021, fixed in 1.9.3 HF3) and the Acronis Backup extension for Plesk (builds before 1.8.11.638, fixed in 1.8.11). Insecure default file permissions on the Linux-based backup component allow an authenticated, low-privileged local attacker to escalate privileges without user interaction and without any special conditions beyond the attacker's control (low attack complexity). Acronis confirmed exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments — based on a single customer report — while Plesk deployments have not been observed exploited; the company withheld technical root-cause and post-escalation attacker-behavior detail specifically to give administrators a patching window before publishing more. Reporting describes a plausible multi-stage chain — initial access via a compromised hosting account, weak credentials, a vulnerable web application, or a web shell, followed by abuse of the vulnerable Acronis component to escalate privileges — with impact in shared-hosting/MSP environments potentially extending to other customers' backup data, system files, and control-panel resources on the same host; because the vulnerable component is itself backup software, a root/administrative foothold gained through it can also be leveraged to delete, corrupt, or disable backup jobs and recovery points, inhibiting incident recovery for affected tenants.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078.001 Default Accounts
- T1505.003 Web Shell
- T1222.002 Linux and Mac Permissions
- T1685.006 Clear Linux or Mac System Logs
- T1059 Command and Scripting Interpreter
- T1005 Data from Local System
- T1490 Inhibit System Recovery
- T1595 Active Scanning
- T1136.001 Create Account
- T1098 Account Manipulation
- T1078.003 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1562 Impair Defenses
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1565 Data Manipulation

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Cisco Security Advisory: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5)
- [Acronis Advisory: Local privilege escalation due to insecure file permissions (SEC-10986)](https://security-advisory.acronis.com/advisories/SEC-10986)
- [Acronis warns of actively exploited flaw in its cPanel backup plugin](https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/)
- [Acronis Patches Exploited Vulnerability in cPanel Backup Plugin](https://www.securityweek.com/acronis-patches-exploited-vulnerability-in-cpanel-backup-plugin/)
- [Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)](https://www.helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886/)
- [Acronis Backup Plugin Vulnerability in cPanel and Plesk Exploited in the Wild](https://cyberpress.org/acronis-backup-plugin-vulnerability-in-cpanel-and-plesk-exploited-in-the-wild/)
- [CVE-2026-76460 (CVSS 10): Cisco ISE Vulnerability Exploited in the Wild](https://securityonline.info/cisco-ise-vulnerability-exploited/)
- [CVE-2026-76460: Cisco Identity Services Engine Software vulnerability profile](https://www.strix.ai/cve/CVE-2026-76460)
- [NVD - CVE-2026-76460 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76460)
- [The Gatekeeper Is the Door: Cisco ISE's Nine-CVE Disclosure and the Identity Infrastructure Attack Surface](https://forkast.news/the-gatekeeper-is-the-door-cisco-ises-nine-cve-disclosure-and-the-identity-infrastructure-attack-surface/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2542