---
title: "Security digest: September 16, 2026"
url: https://erroneo.us/security/2026-09-16/
description: "September 16, 2026 vulnerability digest: 1 brief (Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth…); 3 CISA KEV additions (Acronis, Cisco, Google); 3…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-09-16
date_modified: 2026-09-16
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: September 16, 2026

1 editorial brief, 3 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Act now: Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass . Every organization running Cisco Identity Services Engine or ISE Passive Identity Connector 3.0 through 3.5 for network access control, RADIUS/TACACS+ or identity services, in any deployment size.
- Do you run any of these? Acronis Backup, Cisco Identity Services Engine, Google Pixel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-19.
- PyPI: 2 critical advisories ( djust , lmdeploy ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( @zereight/mcp-gitlab ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass](https://erroneo.us/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/index.md): If you run Cisco ISE or ISE-PIC on any release before the fixed patches, patch now and hunt every node; the bug needs no login, is exploited, and Cisco warns attackers may get root and erase their tracks.

## Known exploited (CISA KEV)

- [CVE-2026-87886](https://erroneo.us/security/cve/CVE-2026-87886/index.md) Acronis Backup: Acronis Backup Incorrect Default Permissions Vulnerability (CISA due 2026-09-19)
- [CVE-2026-76460](https://erroneo.us/security/cve/CVE-2026-76460/index.md) Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability (CISA due 2026-09-19)
- [CVE-2026-58704](https://erroneo.us/security/cve/CVE-2026-58704/index.md) Google Pixel: Google Pixel Improper Authorization Vulnerability (CISA due 2026-09-19)

## Critical advisories

- [CVE-2026-61594](https://erroneo.us/security/cve/CVE-2026-61594/index.md) djust has an authorization bypass on the WebSocket/SSE mount path — PyPI djust < 1.0.7 → 1.0.7
- [CVE-2026-61560](https://erroneo.us/security/cve/CVE-2026-61560/index.md) @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover — npm @zereight/mcp-gitlab < 2.1.27 → 2.1.27
- [CVE-2025-59953](https://erroneo.us/security/cve/CVE-2025-59953/index.md) LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy — PyPI lmdeploy >= 0.9.1, < 0.10.2 → 0.10.2

---
Source page: https://erroneo.us/security/2026-09-16/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt