Look, a CVSS 10.0 on an identity platform is the kind of bug that should map cleanly onto a supervisory module, and this one doesn't. Kai Tanner's filing on CVE-2026-76460 covers an authentication bypass in Cisco Identity Services Engine, the box that decides which devices get on a corporate network at all, added to CISA's Known Exploited Vulnerabilities catalog September 16 (a same-week deadline, which is CISA's way of saying "you don't have a quarter for this one"). Separately, the SFC on September 18 obtained continuation of worldwide freezing orders against Lo Kai Bong and Major Success Group Limited, the Enforcement Division doing what it does with assets that might otherwise walk. Neither story lands on a Hong Kong regulated firm's books the way Thursday's carer pay bump lands on a household budget, but one of them lands on its network.

An unauthenticated bypass in ISE is not an e-banking channel issue, so HKMA's SPM TM-E-1 doesn't reach it, and it isn't a credit-card control either. It sits in general technology risk governance, SPM TM-G-1, the institution-wide framework covering IT governance and sound control practices rather than any specific channel (the module that exists precisely because not every control failure fits a named box). For an authorized institution running ISE anywhere in its wired or wireless estate, the Banking Supervision Department's expectation under TM-G-1 is patch-and-attest on its own clock, not a channel-specific circular deadline. The freezing order continuation, by contrast, is SFO enforcement machinery working exactly as designed: no new obligation for anyone who isn't Lo Kai Bong or Major Success Group.

CISA's catalog entry sets the practical deadline: US federal agencies patch by the date CISA assigns per-CVE, typically two to three weeks out, and Cisco's own advisory is the only clock a Hong Kong institution actually has to watch. There is no HKMA circular coming behind it. The obligation here is the one that was already sitting in TM-G-1 before this bug existed: know your network, patch what CISA flags as exploited, and be ready to show the Banking Supervision Department the timeline when they ask.