Detections

Cisco Identity Services Engine CVE-2026-76460 exploited in the wild

Template: CVE-2026-76460 Identity Services Engine management interface authentication anomalies

spl · template

index=web (uri_path="*" OR api_path="*") | where isnotnull(src_ip) | stats count min(_time) as first_seen max(_time) as last_seen dc(status) as status_variety by src_ip, uri_path, status | sort -count

Template: CVE-2026-76460 Identity Services Engine management interface authentication anomalies

kql · template

WebRequests
| where tostring(url) contains '/'
| summarize count(), makeset(httpStatus),
  min(datetime), max(datetime) by sourceIp, url
| order by count_ desc