Cisco and Acronis Share a CISA Deadline, Not a Severity Score

An unauthenticated attacker with nothing more than a web browser can seize control of a Cisco Identity Services Engine deployment. An Acronis Backup customer needs a valid login already in hand to do far less. The Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog on Wednesday and gave federal civilian agencies the same deadline to fix them: Saturday, Sept. 19.

CISA's Wednesday additions cover CVE-2026-76460, a Cisco Identity Services Engine bug Cisco itself scores a perfect 10.0 out of 10 on the CVSS severity scale, and CVE-2026-87886, a 7.8-rated flaw in Acronis's Backup plugin for cPanel and WHM hosting control panels. Both carry evidence of active exploitation, the standard CISA applies before adding anything to the catalog, and Binding Operational Directive 26-04 sets the clock once an entry lands there.

What the Cisco flaw allows

Cisco's advisory describes an API endpoint in Identity Services Engine and its Passive Identity Connector variant with insufficient authentication controls, letting a remote attacker send it a crafted request and bypass the login screen entirely. "The Cisco PSIRT is aware of active exploitation of this vulnerability," the company's Sept. 16 notice says, and it lists no workaround: the only fix is a patch. Diksha Ojha, a senior technical writer at Qualys, published detection guidance the next day pointing defenders to Qualys QID 317886 and to access.log entries containing unfamiliar usernames, evidence the flaw is already being hunted in the wild rather than treated as theoretical.

The fix list stops at ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Cisco says versions 3.0 and earlier reached end of life before this advisory shipped, so a deployment still running one of those has no patched release to move to at all.

What the Acronis flaw allows

Acronis's flaw needs an attacker who already has a foothold. Insecure file permissions in the Backup plugin for cPanel and WHM on Linux, versions before 1.9.3.1021, let an authenticated but unprivileged attacker escalate straight to root, with low attack complexity and no user interaction required. "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments," Acronis's advisory says, as reported by The Hacker News. Acronis ships the same code as a Backup extension for Plesk, versions before 1.8.11.638, but says it has not observed exploitation there. Fixed builds are 1.9.3 HF3 for the cPanel plugin and 1.8.11 for the Plesk extension.

Flaw	CVSS	Access needed	Fixed in
Cisco ISE, CVE-2026-76460	10.0	None; unauthenticated	3.1 Patch 12 – 3.5 Patch 4
Acronis Backup, CVE-2026-87886	7.8	Valid low-privilege login	1.9.3 HF3 (cPanel), 1.8.11 (Plesk)

The score doesn't set the clock

Cisco's Sept. 16 release was not one advisory but a bundle of 32, including 15 covering Identity Services Engine alone. Two of those other ISE advisories, a hardening release and a separate vulnerabilities notice, also carry a 10.0 score, yet neither appears on CISA's exploited list next to CVE-2026-76460. The catalog is tracking confirmed attacks, not the CVSS number attached to a bug. CISA did the same thing in July, when it gave a Pixel modem flaw scored 8.8 the identical three-day window while three dozen Critical-rated bugs patched the same day sat outside the catalog entirely. The pattern holds again here: a 7.8 sits on the clock next to a 10.0, and a pair of other 10.0s sit off it. The rating measures what a flaw could do in theory; the catalog measures what someone is already doing with it, which is a different question the MikroTik RouterOS botnet campaign made the same point about in August.

What neither company has said

Acronis's advisory does not say what an attacker does after reaching root on a cPanel server, only that the escalation itself is happening. Cisco's notice does not say how many ISE deployments have been hit, who is behind the activity, or how the exploitation was first detected. Both companies are treating disclosure as the patch instruction, not an incident report.

Federal civilian agencies that cannot apply either fix by Saturday are required under BOD 26-04 to pull the affected system off the network rather than leave it running unpatched past the deadline. For Cisco ISE specifically, that means agencies still on version 3.0, with no supported release to upgrade to, have no third option.