Acronis Backup, Cisco ISE, and Pixel Flaws Under Active Exploit

Three vulnerabilities have landed on CISA’s Known Exploited Vulnerabilities catalogue overnight, and two of them sit in systems most small businesses never think about but rely on entirely. CVE-2026-87886 affects Acronis Backup software widely deployed in managed hosting environments. CVE-2026-76460 is a perfect-10 authentication bypass in Cisco’s Identity Services Engine, the network access control system that decides who gets onto your network. CVE-2026-58704 targets Google Pixel devices. All three are confirmed under active exploitation. This episode walks through what each vulnerability means in practical terms, why backup and network access control are central to ransomware defence, and what questions to put to your MSP today. We also cover Cisco’s wider release of more than twenty critical CVEs published in a single day, including multiple routes to full system compromise in firewall and network management infrastructure. For UK small businesses, the direct technical exposure may be limited, but the supply chain risk through managed service providers is not. This is about accountability, not alarm. If your MSP manages these systems on your behalf and hasn’t called you yet, this episode explains what to ask and why the answer matters.

Chapters

• Intro Corrine opens with a question: when did your MSP last call you about a specific, confirmed active exploit in software they manage on your behalf? Three vulnerabilities landed on CISA’s KEV catalogue overnight, affecting backup software, network access control, and mobile devices. Cisco published more than twenty critical CVEs in a single day. The focus is on systems managed by third parties, where patching depends on your MSP, not you.
• Acronis Backup Actively Exploited CVE-2026-87886 is a privilege escalation vulnerability in the Acronis Backup plugin for cPanel and Plesk. Backup software is trusted, has access to everything, and is almost never monitored by the client. Modern ransomware groups target backups first. CISA’s KEV listing confirms active exploitation. Corrine provides three specific questions to put to your MSP: patch status, written confirmation, and when backups were last tested. If you can’t get a clear answer within 48 hours, that’s a contractual concern.
• CTA Corrine invites listeners to follow the show, leave a rating or review, and share the episode with business owners who should be asking these questions.
• Cisco: A Perfect Ten CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco Identity Services Engine. ISE is network access control infrastructure that decides who and what is allowed onto a network. An unauthenticated remote attacker can bypass the management interface and gain full access. Most small businesses don’t run ISE directly, but their MSPs do. A compromise of the MSP’s ISE deployment is a risk to every client on that estate.
• Cisco’s Wider Vulnerability Dump Cisco published more than twenty critical and near-critical CVEs on 16 September across ISE, Nexus Dashboard, Secure Firewall Management Center, and Adaptive Security Appliance products. Multiple vulnerabilities allow unauthenticated remote attackers to gain administrative access, execute arbitrary commands as root, and fully compromise systems. These are central infrastructure systems that large MSPs and managed security providers run on behalf of dozens or hundreds of clients. Direct exposure is limited for small businesses, but supply chain risk through MSPs is not.
• Google Pixel Vulnerability CVE-2026-58704 affects Google Pixel devices: an improper authorisation vulnerability in the cellular modem component allows privilege escalation. If staff use Pixel phones for work email, cloud applications, or any business data access, this needs attention today. The fix is a software update via Settings, Security and emergency, Security update. Apply it immediately. If you have a bring-your-own-device policy, communicate this to staff directly.
• Browser Extensions and AI Assistants Researchers published proof-of-concept work showing that a single malicious browser extension can hijack AI assistants across Chrome, Edge, and related browsers by manipulating the context the AI receives. If staff use AI assistants in the browser for business work, review which browser extensions are installed and remove any that are not explicitly authorised and necessary.
• What This Means for Your Business Corrine provides concrete steps: contact your MSP today about CVE-2026-87886 and CVE-2026-76460, request written confirmation of patch status, check Pixel devices for updates, test your backup by actually restoring a file, and audit browser extensions on machines using AI tools. Proactive vulnerability communication from your MSP is a baseline expectation. If you don’t receive it, the absence is evidence. Use it accordingly.
• Outro The CISA Known Exploited Vulnerabilities catalogue is the most reliable public signal that a vulnerability is being actively weaponised. When something lands on that list, the time for patching is now. Your backup and network access control determine whether you survive a serious attack. Make sure whoever is responsible for them knows what they’re doing.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://sec.cloudapps.cisco.com/security/center/publicationListing.x