Two CVSS 10.0 Vulnerabilities Demand Immediate Action

Two maximum-severity vulnerabilities have emerged within hours of each other, both scoring CVSS 10.0. CVE-2026-76460, an authentication bypass flaw in Cisco Identity Services Engine, is confirmed by CISA as actively exploited in the wild. The vulnerability allows attackers to bypass network access controls entirely, with no credentials required. A second Cisco flaw, CVE-2026-76461 affecting Secure Email Gateway, has also entered CISA’s known exploited vulnerabilities catalogue. Simultaneously, Microsoft disclosed seven CVSS 10.0 vulnerabilities across Azure infrastructure, including Azure Arc, Logic Apps, AI Foundry, Billing, Fabric, and Container Registry. Whilst active exploitation of the Azure flaws remains unconfirmed, the severity ratings reflect maximum impact and exploitability without authentication. UK small businesses face exposure through three vectors: managed service provider dependencies, supply chain relationships, and cloud infrastructure reliance. The episode provides five specific actions to complete before week’s end, including contacting MSPs for written confirmation of patch status, checking Microsoft 365 service health dashboards, and documenting all due diligence steps for ICO accountability and cyber insurance purposes.

Chapters

• Intro Two CVSS 10.0 vulnerabilities disclosed within hours. One actively exploited, confirmed by US government. Both affect infrastructure UK small businesses depend on daily.
• Cisco’s Zero-Day Under Active Attack CVE-2026-76460 authentication bypass in Cisco Identity Services Engine confirmed as actively exploited by CISA. Allows attackers to bypass network access controls without credentials. CVE-2026-76461 in Cisco Secure Email Gateway also enters KEV catalogue. Patches available for both.
• CTA Request to follow, rate, review, and share the podcast.
• Microsoft Azure’s Very Bad Night Seven CVSS 10.0 vulnerabilities disclosed across Azure infrastructure: Arc, Logic Apps, AI Foundry, Billing, Fabric, and Container Registry. Flaws include privilege escalation, missing authentication, path traversal, and authorisation bypass. Active exploitation unconfirmed but conditions present.
• Why This Affects You Even Without Enterprise Kit Three exposure vectors for small businesses: MSP infrastructure dependencies, supply chain relationships, and cloud platform reliance. Cisco ISE compromises at providers create footholds into client environments. Azure vulnerabilities affect any business using Microsoft 365 or Azure-hosted services.
• Knowing This Gives You an Edge Due diligence documentation matters for ICO accountability and cyber insurance claims. Demonstrating active vulnerability tracking supports Cyber Essentials certification and separates genuine security posture from checkbox compliance.
• What to Do Before the End of the Week Five specific actions: contact MSP about Cisco patch status, check Microsoft 365 service health dashboard, review supplier Azure dependencies, verify email security configuration, and document all responses in writing.
• Outro Two CVSS 10.0 vulnerabilities, one confirmed as actively exploited. Practical response requires contacting MSPs, checking service health dashboards, and documenting every step for accountability.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog