Kai Tanner's filing on CVE-2026-76460 is the one a Hong Kong bank's technology risk committee reads first thing this morning. Cisco patched the flaw September 16 in Identity Services Engine, the platform that decides what a laptop, badge reader or point-of-sale terminal is allowed onto the network, and confirmed active exploitation before naming a single victim or sector (which for a bug requiring no login at all is the part worth sitting with). Separately, three days of HKMA notices carried nothing but scam alerts and an Exchange Fund Bills tender result, meaning today's supervisory story isn't a new instrument, it's an old one meeting a live exploit.

So the read is narrower than the CVSS score suggests. TM-G-1 covers the institution-wide technology risk framework, IT governance and sound control practices, not the channel-specific e-banking controls in TM-E-1, and ISE sits upstream of both, authenticating the devices that later touch e-banking systems and the AML transaction-monitoring stack alike. An authentication bypass at that layer doesn't trip TM-E-1's card-not-present monitoring or TM-G-2's continuity testing; it walks past the control those modules assume already happened. Any authorized institution running ISE for network access control has an exploitation window that opened September 16 and closes only when every appliance is patched, and the Banking Supervision Department's on-site examinations will ask for that patch timestamp, not a risk narrative.

There's no consultation close or hearing date attached to a zero-day. The next event with a date on it is whatever an institution's own patch log says, and Cisco's advisory means that log is now examination evidence.