[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJ-P180_Mrn4M1Rk_hrjoEitCL5-qq-h38Wx7WXwsGkY":3},{"article":4,"iocs":46,"watch_terms":59,"solutions":60,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"93d7aad2-f2cd-42a5-87e3-1bfb7209c9ec","Cisco alerts customers to second actively exploited zero-day in as many days","cisco-alerts-customers-to-second-actively-exploited-zero-day-in-as-many-days-234ed8","The latest zero-day has a maximum-severity rating and affects Cisco Identity Services Engine, a product hit with three actively exploited vulnerabilities since June 2025. The post Cisco alerts customers to second actively exploited zero-day in as many days appeared first on CyberScoop.","Cisco has disclosed a second actively exploited zero-day vulnerability, CVE-2026-76460, affecting its Identity Services Engine (ISE). This critical vulnerability allows remote attackers to bypass authentication and gain full control of devices, enabling them to modify network policies and extract credentials. The Cybersecurity and Infrastructure Security Agency (CISA) has added it to its known exploited vulnerabilities catalog, and Cisco recommends immediate upgrades.","Cisco alerts customers to second actively exploited zero-day in as many days.","https:\u002F\u002Fcyberscoop.com\u002Fcisco-ise-zero-day-cve-2026-76460\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-458975641.jpg","2026-09-17T21:03:42+00:00","2026-09-17T22:00:29.298033+00:00",9,[17,20,23,25],{"name":18,"type":19},"Identity Services Engine","product",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":19},"Secure Email Gateway",{"name":26,"type":27},"API","technology","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":28,"icon":30,"name":31,"slug":32},null,"Zero-day","zero-day",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,57],{"type":48,"value":49,"context":50},"cve","CVE-2026-76460","Actively exploited zero-day vulnerability in Cisco Identity Services Engine",{"type":48,"value":52,"context":53},"CVE-2026-76461","Actively exploited zero-day vulnerability in Cisco Secure Email Gateway",{"type":48,"value":55,"context":56},"CVE-2025-20337","Previously exploited vulnerability in Cisco Identity Services Engine",{"type":48,"value":58,"context":56},"CVE-2025-20281",[21,18,24],{"controls":61,"vendors":147},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,111],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":92,"product_name":108,"url":109,"description":110},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":45,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[148],{"slug":149,"name":21,"logo_path":150,"roles":151},"cisco","\u002Fvendor-logos\u002Fcisco.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":169},"cisco-ise-zero-day-allows-auth-bypass-and-full-device-takeover","Cisco ISE Zero-Day Allows Auth Bypass and Full Device Takeover","A critical zero-day vulnerability (CVE-2026-76460) in Cisco's Identity Services Engine allows unauthenticated remote attackers to completely bypass authentication, seize device control, alter network policies, and exfiltrate credentials — all without prior access. The fact that this is the second actively exploited zero-day disclosed by Cisco in consecutive days underscores the urgency of maintaining aggressive patch cycles for network infrastructure components. ISE is a cornerstone of network access control, meaning a compromise here can cascade across an entire enterprise environment. CISA's addition to the Known Exploited Vulnerabilities (KEV) catalog confirms active in-the-wild exploitation, making delayed patching an unacceptable risk.",[158,159,160,161,162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-2: Identification and Authentication","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","CISA KEV Catalog Binding Operational Directive 22-01","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]