Our automated tracking framework flagged that CISA added CVE-2026-76460 (Cisco Identity Services Engine) to the Known Exploited Vulnerabilities (KEV) catalog on September 17, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-76460 by September 19, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-76460 |
| Vendor / product | Cisco Identity Services Engine |
| Vulnerability | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability |
| CVSS base score | 10 |
| Added to KEV | September 16, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | September 19, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Cisco currently ranks #9 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 99 |
| Median lag (public → KEV listing) | 1134 days |
| 0-day rate (exploited at or before disclosure) | 16% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1712 tracked KEV entries is 251 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-76461 | Secure Email Gateway | September 14, 2026 | 0 | No |
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | September 9, 2026 | 189 | No |
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | August 11, 2026 | 0 | No |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | July 29, 2026 | 0 | No |
| CVE-2008-4128 | IOS | July 13, 2026 | 6507 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has urgently added CVE-2026-76460, affecting Cisco Identity Services Engine, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability carries a critical CVSS base score of 10. Given its immediate addition to the KEV catalog on 2026-09-16, with a federal patch deadline of 2026-09-19, organizations using Cisco Identity Services Engine must prioritize patching without delay. The 0-day lag between public disclosure and KEV listing indicates active, widespread exploitation that warrants immediate attention.
The extreme urgency comes from the critical CVSS score and the direct evidence of in-the-wild exploitation. While not currently linked to ransomware, the vulnerability’s nature makes it an attractive target for initial access brokers and other threat actors. Organizations, particularly those managing identity and access controls with Cisco Identity Services Engine, are most exposed. The 0-day lag signals that exploitation began immediately upon disclosure, offering no detection window prior to KEV listing.
If you can’t apply the patch before the 2026-09-19 deadline, isolate affected systems, enhance network segmentation, strengthen monitoring for anomalous activity around Identity Services Engine deployments, and enforce least privilege access. This 0-day listing reinforces the severity and immediate threat posed by CVE-2026-76460.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Cisco’s CVE-2026-20349 Was Exploited in 0 Days — Well Under Its 1245-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
