Future-Dated CISA KEV Alert for Cisco ISE and Acronis Backup Cannot Be Verified

Key points

• Source claims CISA added CVE-2026-76460 (Cisco ISE) and CVE-2026-87886 (Acronis Backup) to KEV.
• The linked CISA URL is dated September 16, 2026, which is after the current date and cannot be confirmed.
• If true, both flaws involve privilege/API or default-permission weaknesses and active exploitation.
• K-12 and government agencies should not act on unverified KEV entries without checking CISA directly.
• Monitor CISA KEV and vendor advisories for Cisco ISE and Acronis Backup.

A recent item attributed to CISA states that two vulnerabilities have been added to the Known Exploited Vulnerabilities Catalog: CVE-2026-76460, described as an incorrect use of privileged APIs in Cisco Identity Services Engine, and CVE-2026-87886, described as incorrect default permissions in Acronis Backup. The item also references active exploitation and a binding operational directive for federal civilian agencies. However, the URL provided is dated September 16, 2026, which is later than the current date of June 29, 2026. That future timestamp means the alert cannot be confirmed as a real, published CISA advisory at this time.

If the underlying vulnerabilities are real, the affected products are widely used in enterprise and government environments. Cisco ISE often controls network access and identity policy, while Acronis Backup protects critical data. Flaws involving privileged APIs or default permissions can lead to privilege escalation, unauthorized access, or data compromise. Active exploitation would raise the urgency significantly, especially for internet-facing systems.

The KEV process is important because it signals that a vulnerability is being exploited in the wild, not merely that a patch exists. Agencies subject to CISA directives are expected to prioritize remediation of KEV entries on exposed assets. For K-12 and other public-sector organizations, the same logic applies even without a federal mandate: known exploited flaws should be patched quickly and compensating controls applied where patching is delayed.

Because this specific alert is future-dated and unverified, the right response is caution rather than immediate action on the claimed CVEs alone. Verify directly through CISA’s official KEV catalog and the vendors’ security advisories. If confirmed, treat the flaws as high priority, locate affected Cisco ISE and Acronis Backup instances, and follow vendor remediation guidance. Watch for official updates, corrected dates, and any revision to the CVE details.

What to do now

1. Verify the alert directly on cisa.gov and the official Cisco and Acronis security advisory pages before acting on the listed CVEs.
2. If confirmed, inventory all Cisco Identity Services Engine and Acronis Backup instances, prioritizing internet-facing and privileged systems.
3. Apply vendor security updates or mitigations for CVE-2026-76460 and CVE-2026-87886 as soon as they are available and tested.
4. For Cisco ISE, restrict privileged API access to trusted management networks and enforce least-privilege roles for administrative accounts.
5. For Acronis Backup, review and correct default file and directory permissions, remove unnecessary write access, and rotate exposed credentials.
6. Hunt for signs of exploitation in authentication, API, and backup service logs; isolate or rebuild any confirmed compromised hosts.
7. Track CISA BOD 26-04 remediation timelines if in scope, and document any exceptions or compensating controls.

CVE references

• CVE-2026-76460
• CVE-2026-87886

Original source

CISA Advisories