CVE-2026-76460 is an authentication bypass in Cisco Identity Services Engine, the platform that decides which device gets onto the network before anyone checks a password. It scores a 10.0 on CVSS, the ceiling of the scale, and CISA added it to the Known Exploited Vulnerabilities catalog on September 16. A perfect score on an identity broker means the flaw does not weaken the front door. It removes it.

The practical damage lands on whoever configured ISE as the trust anchor for network access, which for a bank branch network is usually everyone with a badge and a laptop. A second Cisco flaw disclosed the same week, CVE-2026-76461, is a SQL injection in Secure Email Gateway rated 9.8, also now in the KEV catalog as of September 14. Two maximum-tier bugs in the same vendor's stack within 48 hours is not a coincidence worth debating. It is a bad patch cycle, and the CISA deadline clock started on both the day they were listed.

Cisco owns both CVE-2026-76460 and CVE-2026-76461, the ISE authentication bypass and the Secure Email Gateway injection, and both carry active-exploitation confirmation from CISA rather than a vendor's own telemetry. The ISE flaw's CVSS score has no room left to climb. The email gateway bug's EPSS probability sits low for now, but KEV listings do not wait for EPSS to catch up.