Cisco ISE privileged-API bug added to CISA's exploited list
On September 16, 2026, CISA added CVE-2026-76460, an incorrect use of privileged APIs in Cisco Identity Services Engine, to the Known Exploited Vulnerabilities catalog because of evidence it was being exploited.
What was reported
CISA's September 16, 2026 alert names CVE-2026-76460 as "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability" and says the catalog addition is based on evidence of active exploitation. The alert does not describe what the bug lets an attacker do beyond that title. This note does not add that detail.
How to prevent it
A KEV listing means the bug is already in use. If you run Cisco ISE, install Cisco's fix for CVE-2026-76460 and assume an appliance that was reachable before the patch needs a compromise check, not only an update.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.