Cisco
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
At a glance
Actively exploited in the wild — prioritise confirming exposure.
High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Cisco Identity Services Engine, treat it as Critical.
Briefing
- Organisations using Cisco Identity Services Engine should assess their exposure to CVE-2026-76460 given the high exploitation probability.
Questions to ask IT
- Do we run Cisco Identity Services Engine, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 14 Nov?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-76460- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Listed: attacks using it have been seen
- Elevated attack likelihood (~75.6% in 30 days)
- CVE-2026-76460 is confirmed as exploited in the wild according to the US known-exploited catalogue.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- A vulnerability in Cisco Identity Services Engine involves incorrect use of privileged APIs, with a high probability of exploitation.
- CVE-2026-76460 has a 66.6% estimated chance of exploitation in the next 30 days, according to estimated attack likelihood.
Products and services involved
- Cisco Identity Services Engine93% match confidence · CVE-2026-76460
Pulse
Last checked 56m ago · Next recheck 14 Nov 2026, 14:03 UK time · 1 quiet check collapsed
- Story25 Oct 2026, 08:07 UK time · 25 Oct
Linked reporting from (official standard body).
Read source (FIRST EPSS) - Update13 Nov 2026, 14:03 UK time · 56m ago
held at 66.6%; ranking metadata was updated.
2 entries so far. The timeline chart appears once this story has more history.
Sources
CVE-2026-76460: elevated exploitation probability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- ProbableSummary fact75% confidence
CVE-2026-76460 has an estimated attack likelihood score of 0.666 (~66.6% estimated chance of exploitation in the next 30 days; 99.3th percentile) as of 2026-10-24. This is a probability signal from FIRST, not confirmed exploitation.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-76460
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-76460 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-76460 has an estimated ~66.6% chance of attack in 30 days (99.3th percentile) as of 2026-10-24 — probability signal, not confirmed exploitation