The Cybersecurity and Infrastructure Security Agency (CISA) added a critical Cisco identity-management vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog after finding evidence that attackers are using the flaw.
The vulnerability, tracked as Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-76460, affects Cisco Identity Services Engine (ISE). Cisco assigned the flaw the maximum Common Vulnerability Scoring System score of 10.0 in a Sept. 16 security advisory.
The directive gives federal agencies until Sept. 19 to remediate affected publicly exposed systems.
CISA’s KEV entry also requires forensic triage under Binding Operational Directive (BOD) 26-04, which directs federal civilian executive branch agencies to prioritize rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets when exploitation would grant an attacker total control.
Cisco said insufficient authentication controls on an application programming interface endpoint could allow an unauthenticated, remote attacker to send a crafted request and bypass the product’s web-based management interface.
Successful exploitation may allow an attacker to execute commands with root privileges, according to Cisco. That level of access could also allow threat actors to remove or conceal evidence from the compromised device.
Cisco released software updates to address the flaw and said no workaround is available. The company urged administrators who suspect exploitation to review logs outside the affected appliance because local evidence may have been altered or deleted.
CISA added the vulnerability to its KEV Catalog on Sept. 16 alongside an actively exploited Acronis Backup permissions vulnerability.
“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said.
CISA directs agencies to apply mitigations according to Cisco’s instructions, comply with BOD 26-04, and follow CISA’s forensic triage requirements.
The agency also directs stakeholders to evaluate each asset’s internet exposure and comply with the directive’s patching requirements.
BOD 26-04 establishes vulnerability management requirements for federal civilian executive branch agencies and requires them to prioritize high-risk KEV vulnerabilities based on factors including public exposure and the level of control an attacker could obtain after exploitation. The directive also establishes requirements for determining whether systems were compromised before remediation.
While BOD 26-04 applies to federal civilian executive branch agencies, CISA encouraged other organizations to adopt a risk-based approach to vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.