CVE-2026-76460 lets an unauthenticated attacker skip login entirely on Cisco Identity Services Engine, the platform banks use to decide which device gets onto which segment of the network. CISA added it to the Known Exploited Vulnerabilities catalog on September 16, one day after Cisco's advisory, which means the exploitation timeline and the patch timeline are running concurrently rather than the patch arriving first. Cisco's bulletin calls the flaw critical. CVSS scored it a flat 10.0, the maximum possible, reserved for bugs that need no authentication, no user interaction and no privileged starting position to hand over full control.

The practical exposure is Identity Services Engine sitting at the center of network access control, so a bypass there does not just compromise one box, it compromises the trust decision every other segment relies on. Cisco's own email security line has a second critical bug this week, CVE-2026-76461, a SQL injection in Secure Email Gateway that a September 15 advisory said gives root access from a single malicious message, already exploited in the wild before the patch landed. Two Cisco products, two root-level bugs, two active-exploitation windows in the same seven days is not a coincidence worth softening. It is a bad week for one vendor's advisory queue, and the queue is public.

The security team running Identity Services Engine on-prem is the one exposed here, not the cloud tenant with automatic patching. Cisco has published fixes for both CVE-2026-76460 and CVE-2026-76461. The clock that matters now is how fast each bank's network team can push an emergency change through its own approval process, because CISA's KEV listing already confirms attackers do not need to wait for that process to finish.