Skip to content
Sign in

Cisco product

Identity Services Engine

Alert
No CISA KEV deadline is open. CISA last added an Identity Services Engine CVE on 16 Sep.

Tracked since 16 Sep · latest article 1 Oct · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 3 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date3

Identity Services Engine CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Identity Services Engine CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-76460Identity Services Engine16 SepPassed 19 Sep8
In CISA KEVCVE-2025-20281Identity Services Engine28 JulPassed 18 Aug–
In CISA KEVCVE-2025-20337Identity Services Engine28 JulPassed 18 Aug–
Vendor CSV of 101 entries for CiscoAll 101 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Identity Services Engine CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’252Q3 ’250Q4 ’250Q1 ’260Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20252
Q4 20250
Q1 20260
Q2 20260
Q3 20261
Q4 20260

Fix listed

0 of 1 CVE in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-76460: 99.5th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-7646099.5

Coverage8 articles · all time

The latest 8 articles naming Identity Services Engine, in the shared story grammar.

Full timeline
Quiet for 4 weekslast report 1 Oct8 articles6 outlets

8 articles from 6 outlets since 16 Sep. Quiet since 1 Oct.

Now16 Sep181920212 OctFirst reportCISA · 16 Sep, 19:03Picked up againafter 2 days quiet
  • Wed 16 Sep, 19:03 UTC. CISA, first report. Attackers Exploit Cisco ISE Flaw to Bypass Management Interface. Cites a CVE in CISA KEV.
  • Wed 16 Sep, 19:36 UTC. SecurityOnline, its first report on the story. Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 06:36 UTC. SecurityWeek, its first report on the story. Cisco Patches Zero Day Letting Attackers Take Root Access in ISE. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 11:19 UTC. Infosecurity, its first report on the story. Attackers Exploit Critical Cisco ISE Flaw for Root Access. Cites a CVE in CISA KEV.
  • Fri 18 Sep, 20:23 UTC. Dark Reading, its first report on the story. Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 14:52 UTC. Infosecurity. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Wed 16 SepDay 02
    1. Attackers Exploit Cisco ISE Flaw to Bypass Management Interface19:03 · CISA · official · First report · CISA alert · Known exploited CVE
    2. Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access19:36 · SecurityOnline · Known exploited CVE
  2. Thu 17 SepDay 13
    1. Cisco Patches Zero Day Letting Attackers Take Root Access in ISE06:36 · SecurityWeek · Known exploited CVE
    2. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Critical Cisco ISE Flaw for Root Access11:19 · Infosecurity · Known exploited CVE
  3. Fri 18 SepDay 21
    1. Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access20:23 · Dark Reading · Known exploited CVE

  4. Quiet for 2 days

    Mon 21 SepDay 51
    1. Cisco Warns of Actively Exploited Flaws Enabling Root Access02:59 · SecurityOnline · Picked up again · Known exploited CVE

  5. Quiet for 10 days

    Thu 1 OctDay 151
    1. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers14:52 · Infosecurity · Picked up again · Known exploited CVE

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-76460Exploited

    Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

    10.0Critical76% EPSS · 8 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in