ThreatScope

Cisco ISE, Secure Email Gateway and Acronis Hosting Risks | September 16–22, 2026

Reporting period: September 16–22, 2026
Threat level: Critical for affected, attacker-reachable systems

🎧 Listen to this week’s ThreatScope (audio brief)

Executive Snapshot

This week’s ThreatScope focuses on three actively exploited vulnerabilities affecting network access control, email-security infrastructure and specific hosting backup integrations. The affected technologies occupy trusted positions within enterprise environments, which means investigation should consider not only the vulnerable system but also the services, credentials and systems accessible through it.

The highest operational priority is Cisco Identity Services Engine (ISE) and ISE-PIC CVE-2026-76460. The vulnerability can allow an unauthenticated attacker with network access to the affected API to bypass authentication and potentially execute commands with root privileges.

Cisco Secure Email Gateway CVE-2026-76461 is also under active exploitation. Because compromise can affect email processing and, in clustered environments, potentially expose SSH keys used between appliances, recovery may need to extend beyond the initially affected node.

The third actively exploited vulnerability, CVE-2026-87886, affects specific Acronis backup integrations for cPanel & WHM and Plesk. It requires an existing local, low-privilege foothold and should not be generalised to other Acronis products.

Is This Report Relevant to Your Organization?

This report is particularly relevant if your organisation operates:

The key question this week is what the affected system controls or can access. Cisco ISE participates in network-access decisions, Secure Email Gateway processes business communications, and backup integrations operate with elevated privileges on hosting systems.

Executive Summary

Three actively exploited vulnerabilities define the main operational priorities for this reporting period.

Cisco ISE / ISE-PIC CVE-2026-76460 is rated CVSS 10.0. Insufficiently protected API functionality can allow authentication bypass and potentially root-level command execution. No credentials are required, but the attacker must have network access to the affected API. Cisco states that affected deployments are vulnerable regardless of configuration.

Cisco Secure Email Gateway CVE-2026-76461, rated CVSS 9.8, involves SQL injection during email processing that can lead to operating-system command execution as root. Cisco’s September 17 update also adds an important recovery consideration for clustered appliances: exposed cluster SSH keys may allow compromise of peer systems.

Acronis hosting backup integrations CVE-2026-87886, rated CVSS 7.8, involves insecure file permissions. A local attacker with low-privilege access to the Linux host may manipulate files or paths used by a privileged backup service and potentially gain root-level execution. Active exploitation has been reported by CSIRT Italia.

The reporting period also includes a broader Cisco ISE hardening release, addressing additional vulnerability classes involving injection, access control, credential protection, input validation and privilege management. These findings should not be interpreted as separate confirmed exploitation campaigns.

Key Vulnerabilities

The vulnerabilities have different attack prerequisites. Cisco ISE can be attacked remotely where the affected API is reachable, Secure Email Gateway can be targeted through crafted email processing, while the Acronis issue requires existing low-privilege access to the Linux host.

Vulnerability Analysis

Cisco ISE / ISE-PIC – CVE-2026-76460

Status: Actively exploited / CVSS 10.0

CVE-2026-76460 affects Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC).

Insufficient protection of API functionality can allow an attacker to bypass authentication and potentially execute commands with root privileges. The attacker does not require credentials, although network access to the affected API is necessary.

Cisco states that affected deployments are vulnerable regardless of configuration.

Corrected releases include:

Cisco provides no complete workaround. Temporary mitigation consists of restricting management and control-plane traffic through infrastructure access-control lists.

Required Response

Upgrade affected deployments to the applicable corrected release and restrict management access while remediation is in progress.

Review API access logs across every node, including suspicious usernames and unexpected administrative activity. Correlate local findings with independently collected network and security telemetry because evidence on the affected system may be incomplete or deleted.

Review changes to authorisation policies, newly added administrators, API integrations and trusted endpoints. Compare configuration changes against approved change records.

Where malicious activity is suspected, preserve relevant evidence and follow Cisco’s recovery guidance, which may include re-imaging affected nodes.

Cisco ISE – Wider Hardening Requirements

Cisco’s September 16 release also addresses additional vulnerability classes with severity ratings reaching CVSS 10.0.

They include weaknesses related to injection, improper access control, transfer of resources between security boundaries, insufficient credential protection, input validation and privilege management.

These entries represent grouped vulnerability classes and should not be interpreted as six independently observed exploitation campaigns.

There is also an important lifecycle consideration. ISE 3.1 and 3.2 receive only Critical-severity fixes in these releases, so broader hardening requires migration. ISE-PIC’s last supported release is 3.4, while releases 3.0 and earlier also require migration.

Required Response

Track two separate outcomes:

1. Closure of the actively exploited vulnerability.
2. Completion of the broader hardening or migration requirement.

A generic “patched” status may otherwise conceal remaining security work.

Cisco Secure Email Gateway – CVE-2026-76461

Status: Actively exploited / CVSS 9.8

CVE-2026-76461 affects Cisco Secure Email Gateway. SQL injection during email parsing can lead to operating-system command execution with root privileges.

Corrected releases include:

Cisco recommends migration to 16.5.0-780 and reports that its Secure Email Cloud devices have been upgraded.

The September 17 update adds an important consideration for clustered environments. If cluster SSH keys have been exposed through a compromised appliance, peer appliances may also require investigation and recovery.

Required Response

Upgrade affected appliances and review mail logs and external traffic records for suspicious SQL statements and related activity.

Assess changes to mail routing, relays, filtering and quarantine policies. Review administrator accounts and unexpected changes in administrative access.

Where compromise is suspected, preserve forensic information before recovery. Cisco recommends rebuilding compromised virtual appliances and renewing affected credentials and cryptographic material.

For clustered environments, determine whether the compromise scope includes other members of the cluster before considering recovery complete.

Acronis Hosting Backup Integrations – CVE-2026-87886

Status: Active exploitation reported / CVSS 7.8

CVE-2026-87886 concerns insecure file permissions in specific Acronis Linux hosting backup integrations.

Affected products are:

A local attacker with existing low-privilege access to the Linux host may manipulate files or paths used by a privileged backup service and potentially achieve root-level execution.

The advisory reports active exploitation. The finding applies to these integrations and should not be generalised to every Acronis product.

Required Response

Identify hosting servers running the affected integrations and verify the exact installed versions through administrative inventory.

Upgrade affected installations to the corrected versions.

Review unexpected privileged processes, changes to backup jobs, altered service files and unauthorised access to backup credentials.

Where an existing host compromise is identified, validate the recovery environment independently. A successful backup-job status does not by itself establish that the recovery environment remains trustworthy.

What Deserves Attention This Week?

Network Access Control

Priority: Cisco ISE / ISE-PIC
Focus: API reachability, authentication bypass, root-level execution, policy integrity and evidence of compromise.

Email Security

Priority: Cisco Secure Email Gateway
Focus: email-processing exploitation, administrative access, mail-flow integrity, credentials, cryptographic material and cluster relationships.

Hosting & Backup

Priority: Acronis cPanel & WHM and Plesk integrations
Focus: installed versions, existing host compromise, privileged processes, backup configuration and recovery integrity.

Infrastructure Hardening

Priority: Cisco ISE lifecycle and hardening
Focus: correcting the exploited vulnerability separately from broader migration and hardening requirements.

Recommended Management Actions

Immediate Actions (0–7 Days)

• Identify affected Cisco ISE / ISE-PIC, Secure Email Gateway and Acronis hosting integration deployments.
• Establish exact installed versions and relevant network reachability.
• Apply the applicable vendor-supported corrections.
• Restrict unnecessary access to Cisco ISE management and control-plane interfaces.
• Begin compromise assessment for attacker-reachable Cisco ISE deployments.
• Review Cisco Secure Email Gateway logs, administrative activity and mail-policy changes.
• Determine whether compromised Email Gateway appliances are part of a cluster and whether peer systems require investigation.
• Review affected hosting servers for unexpected privileged activity and changes to backup services.
• Preserve relevant evidence before rebuilding or recovering suspicious systems.
• Renew exposed credentials, keys and cryptographic material after containment where compromise is established or reasonably suspected.

Actions Within 30 Days

• Complete documented compromise assessments for affected exposed systems.
• Independently verify corrected software and integration versions.
• Review Cisco ISE authorisation policies, administrators, API integrations and trusted endpoints.
• Complete required Cisco ISE hardening or document outstanding migration requirements.
• Validate email routing, filtering and quarantine configurations against approved baselines.
• Review cluster relationships and recovery status across Cisco Secure Email Gateway deployments.
• Validate backup configuration, credentials and recovery capability for affected hosting systems.
• Review central log retention to ensure investigations do not depend solely on evidence stored on potentially compromised systems.

Strategic Actions (Within 90 Days)

• Strengthen segmentation of security-management interfaces and control-plane services.
• Reduce unnecessary network reachability of administrative APIs.
• Separate emergency vulnerability remediation from broader platform lifecycle and hardening work.
• Improve independent collection and retention of security telemetry.
• Review how credentials, keys and trusted relationships are shared across clustered infrastructure.
• Strengthen monitoring for privileged execution originating from low-privilege hosting processes.
• Include recovery-environment integrity in backup-security assessments.
• Test incident-response procedures for compromise of network-access and email-security infrastructure.

Enterprise Exposure Assessment

This week’s priorities should be evaluated through four questions.

1. Can an Attacker Reach the Vulnerable Component?

For Cisco ISE, determine whether the affected API was reachable from internet-facing networks, user segments, VPN connections, vendors or other potentially untrusted paths.

For Acronis hosting integrations, external exposure alone does not establish exploitability. The vulnerability requires an existing low-privilege foothold on the Linux host.

2. What Does the System Control?

Cisco ISE may influence employee connectivity, administrative access, third-party connections and access to operational networks.

Secure Email Gateway controls the processing and routing of business email.

Backup integrations interact with recovery infrastructure and operate through privileged services.

The operational impact should therefore be assessed according to the role and trust relationships of the affected system, not CVSS alone.

3. Could Exploitation Have Occurred Before Remediation?

For actively exploited systems, installing the corrected version does not establish that earlier compromise did not occur.

Review historical access, configuration changes, administrative activity and independent telemetry covering the exposure period.

Where logging is incomplete, document the limitation rather than treating the absence of evidence as confirmation that the system was unaffected.

4. Does Recovery Need to Extend Beyond the Original System?

A compromised Cisco ISE node may require validation of access policies, administrators and trusted endpoints.

A compromised Secure Email Gateway may expose credentials, cryptographic material and, in clustered environments, SSH keys used to communicate with peer appliances.

A compromised hosting server may also affect confidence in its backup and recovery environment.

The remediation boundary should follow these relationships.

Ongoing Security Controls

Security teams should continue to:

• maintain verified inventories of security and infrastructure platforms;
• record exact installed versions and patch history;
• restrict administrative interfaces to approved networks;
• centralise security logs and maintain appropriate retention;
• correlate local appliance activity with independent network telemetry;
• monitor privileged administrative and API activity;
• maintain approved configuration baselines;
• monitor unexpected changes to access and email-security policies;
• protect credentials, certificates and cryptographic material;
• independently test backup recoverability;
• document service owners, dependencies and recovery procedures.

Questions for Leadership

Boards and executive teams should ask:

• Do we operate Cisco ISE, ISE-PIC or Cisco Secure Email Gateway in affected versions?
• Which affected interfaces were reachable during the exposure period?
• Have exposed Cisco ISE deployments been assessed for compromise, not only updated?
• Have network-access policies or trusted endpoints changed unexpectedly?
• Could compromise of an Email Gateway affect other members of the same cluster?
• Have credentials, certificates or cryptographic material accessible from affected appliances been reviewed?
• Do any hosting environments use the affected Acronis cPanel or Plesk integrations?
• If a hosting server was compromised, has the integrity of its backup and recovery environment been independently validated?
• Are broader Cisco ISE migration requirements being tracked separately from the emergency fix?
• Which remediation exceptions remain open, and who owns the associated risk?

ISO 27001 Alignment

The actions in this report support key areas of an Information Security Management System (ISMS), including:

• asset and vulnerability management;
• identity and privileged-access management;
• network access control;
• secure configuration;
• logging and monitoring;
• incident investigation and response;
• cryptographic material protection;
• backup and recovery;
• change management;
• technology lifecycle management;
• risk treatment and management review.

For actively exploited systems, evidence of remediation should include both technical correction and appropriate assessment of possible prior compromise.

ISO 9001 Alignment

The recommended actions also support quality-management principles through:

• defined ownership;
• controlled change management;
• documented corrective actions;
• independent verification of remediation;
• evidence-based decision-making;
• recovery validation;
• management review;
• continual improvement.

A remediation record should distinguish between an emergency security correction and any remaining migration, hardening or recovery work.

Need Help Assessing Your Exposure?

If your organisation operates any of the technologies covered this week, begin by confirming the exact product and version, network reachability, exposure period and available investigation evidence.

Where compromise is suspected, the assessment should also consider connected systems, credentials, keys, configuration changes and recovery dependencies.

DIAMATIX supports organisations with exposure assessment, continuous security monitoring, Managed Detection and Response as a Service (MDRaaS), Security Operations Center as a Service (SOCaaS) and Incident Response.

Contact our team to discuss your environment.

Conclusion

This week’s priorities involve three different attack conditions, and that distinction matters for remediation.

Cisco ISE CVE-2026-76460 can be exploited remotely without credentials when the affected API is reachable. Because the platform participates directly in network-access decisions, investigation should include policy integrity, administrative changes and trusted endpoints.

Cisco Secure Email Gateway CVE-2026-76461 introduces both appliance-level and recovery considerations. In clustered environments, exposed SSH keys may extend the investigation beyond the initially compromised appliance.

Acronis CVE-2026-87886 has a different prerequisite: an attacker must already have low-privilege local access to the Linux host. The vulnerability can then provide a path to elevated privileges through the affected cPanel or Plesk backup integration.

For actively exploited, attacker-reachable systems, the practical sequence remains:

Identify Exposure → Contain → Remediate → Assess for Compromise → Recover → Validate

The objective is to establish not only that the vulnerable software has been corrected, but that the affected system and the trust relationships around it can safely return to operation.

Sources

• Cisco ISE Security Advisory
• Cisco ISE Hardening Advisory
• Cisco Secure Email Gateway Security Advisory
• Cisco Secure Email Gateway Recovery Guidance
• CSIRT Italia Security Advisory
• CSIRT Toscana Security Advisory
• Acronis SEC-10986

Methodology

ThreatScope by DIAMATIX is based on verified vulnerability and threat intelligence, prioritising confirmed exploitation, realistic attacker access, system privileges and the operational role of affected technologies.

Applicability should be validated against the organisation’s actual asset inventory, installed versions, network reachability and configuration.

A vulnerable version does not by itself confirm compromise. Likewise, successful remediation does not establish that exploitation did not occur during the previous exposure period.

Investigation hypotheses should be validated against local logging and normal administrative behaviour before being used as indicators of compromise or automated containment criteria.

Trusted · Innovative · Vigilant