CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 16 September 2026. They are CVE-2026-76460 in Cisco Identity Services Engine (ISE), rated CVSS 10.0; CVE-2026-87886 in Acronis Backup, with no CVSS score listed; and CVE-2026-58704 in Google Pixel devices, rated CVSS 8.8 in the catalogue. Cisco describes CVE-2026-76460 as an authentication bypass caused by inadequate checks on an API endpoint.

An unauthenticated remote attacker could send a specially crafted request to gain unauthorised access through the web-based management interface. Cisco’s PSIRT said it was aware of active exploitation and urged customers to upgrade to a fixed release.

CVE-2026-87886 is a local privilege-escalation flaw caused by insecure file permissions in the Acronis Backup plugin for cPanel & WHM and the Backup extension for Plesk. A limited-privilege local attacker could manipulate backup-service files and potentially execute code with root-level privileges. Acronis reported limited, targeted exploitation in the wild.

Google’s September 2026 Pixel security update addresses CVE-2026-58704, an improper-authorisation flaw in the cellular modem caused by a logic error and permission bypass. Google said there were indications of limited, targeted exploitation. The issue does not require user interaction and may allow remote, proximal or adjacent privilege escalation, although Google has not disclosed the attackers, targets or full attack chain.

Under Binding Operational Directive 22-01, US federal civilian agencies must remediate KEV-listed vulnerabilities by their assigned deadlines. Private organisations are also advised to review the catalogue and address affected systems, with Cisco and Google customers directed to apply the relevant security updates.