erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: September 16, 2026

1 editorial brief, 3 known exploited (cisa kev) additions and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass. Every organization running Cisco Identity Services Engine or ISE Passive Identity Connector 3.0 through 3.5 for network access control, RADIUS/TACACS+ or identity services, in any deployment size.
  • Do you run any of these? Acronis Backup, Cisco Identity Services Engine, Google Pixel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-19.
  • PyPI: 2 critical advisories (djust, lmdeploy). Check with pip-audit (or: pip show <package>).
  • npm: 1 critical advisory (@zereight/mcp-gitlab). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-76460

Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass

If you run Cisco ISE or ISE-PIC on any release before the fixed patches, patch now and hunt every node; the bug needs no login, is exploited, and Cisco warns attackers may get root and erase their tracks.

Must act: Every organization running Cisco Identity Services Engine or ISE Passive Identity Connector 3.0 through 3.5 for network access control, RADIUS/TACACS+ or identity services, in any deployment size.

Can relax: Organizations that do not run Cisco ISE or ISE-PIC; other Cisco products are not named in this advisory.

  1. Inventory every ISE and ISE-PIC node in every deployment and record its release and patch level.
  2. Install 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 on all nodes; migrate ISE 3.0 to a supported release.
  3. Until patched, use infrastructure ACLs so only required management and control-plane traffic can reach ISE nodes.

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-87886Acronis Backup
Acronis Backup Incorrect Default Permissions Vulnerability		2026-09-19
CVE-2026-76460Cisco Identity Services Engine
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability		2026-09-19
CVE-2026-58704Google Pixel
Google Pixel Improper Authorization Vulnerability		2026-09-19

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 2

Check: pip-audit (or: pip show <package>)

npm 1

Check: npm audit (or: npm ls <package>)