Cisco shipped patches on September 16 for CVE-2026-76460, a CVSS 10 authentication bypass in Identity Services Engine, the platform that authenticates devices and enforces access policy before anything touches the rest of the network. Cisco's advisory says the flaw is under active exploitation. The company did not name a threat actor or an affected sector, which for a CVSS 10 bug already being used against real targets is itself the notable omission.

ISE sits in front of the network, deciding what a laptop, badge reader or point-of-sale terminal is allowed to reach. An authentication bypass there means an attacker skips the part of the system whose entire job is checking credentials, and CVE-2026-76460 requires no login to trigger. Any bank or insurer running ISE for network access control now has a live exploitation window between patch release and the day every appliance actually gets updated, and that gap is measured in the operations calendar of whoever owns the box, not in Cisco's release notes. A second Cisco bug this week, CVE-2026-76461, a SQL injection in Secure Email Gateway rated 9.8, was added to CISA's Known Exploited Vulnerabilities catalog on September 14, two days before the ISE advisory.

Two maximum-severity Cisco vulnerabilities landing in the same week, both already flagged by CISA, is the fact that matters here: identity infrastructure and email gateway infrastructure, the two systems most APAC banks assume are boring and therefore unwatched. Check Point's SmartConsole authentication bypass, CVE-2026-16232, sits on the same CISA KEV list with 72% EPSS, meaning three separate vendors an APAC bank likely runs concurrently now carry actively-exploited, no-login-required bugs on the same week's list.