CISA Flags Actively Exploited Flaws in Cisco ISE and Acronis Backup

What Happened

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-76460 affecting Cisco Identity Services Engine (ISE) and CVE-2026-87886 in Acronis Backup. The Cisco flaw involves incorrect use of privileged APIs, while the Acronis issue stems from incorrect default permissions. Both are being exploited in the wild by threat actors targeting organizations of all sizes.

Why SMBs Should Care

These aren't theoretical risks—attackers are actively using these vulnerabilities right now. Cisco ISE is a common network access control solution, and Acronis Backup is popular among SMBs for data protection. If you're running either platform, unpatched systems could allow attackers to escalate privileges, gain unauthorized access, or compromise your backup infrastructure—a favorite ransomware tactic. Identity platforms and backup systems are high-value targets because they control access and recovery capabilities. Patching these immediately should be a top priority, and if you've been running vulnerable versions, you should check for signs of compromise before assuming you're safe.

Read the full CISA alert

Take Action

Not sure if you're exposed or need help prioritizing patches across your infrastructure? O-Cyrus helps SMBs manage vulnerability remediation, identity security, and backup integrity as part of a practical security program. Contact our team or learn more about our security services.