The identity layer: 2.6 million attacks, a single CVSS 10.0 flaw and a breach affecting 10,218,802 people

The same day, two different measures

16 September 2026 turned out to be a day on which four independent records fell together. Taiwan's Minister of Digital Affairs Lin Yi-jing said during talks in Washington that the country faces roughly 2.6 million cyber attacks a day. The US Cybersecurity and Infrastructure Security Agency, CISA, added the flaw numbered CVE-2026-76460 in Cisco's Identity Services Engine to its Known Exploited Vulnerabilities catalogue with a score of 10 out of 10 on the CVSS scale. The Personal Data Protection Authority published, under its decision 2026/2039, the data breach notifications of 12 companies; 10,218,802 people were affected at the 11 companies for which a figure could be determined. CloudSEK, for its part, reported that ransomware activity targeting the Middle East had risen more than twentyfold, from 17 threat intelligence records in April 2025 to 357 records in June 2026.

These four numbers do not sit on the same scale. 2.6 million is a measure of volume; it rests on the ministry's own measurement and has not been confirmed by a third party. Because volume also includes automated scanning traffic, it can serve as the justification for a defence budget, but it does not show the breaking point. CVSS 10.0, by contrast, is a structural measure: it means that an unauthenticated remote attacker can bypass authentication in the web-based management interface with a single crafted request and run commands with root privileges. The total of 10,218,802 people is likewise a measure that crosses a threshold: gathered in a single board decision, that number turns the incident from a technical case into a regulatory file.

The target is now identity itself

CVE-2026-76460 arises from the improper use of privileged APIs in Cisco ISE. According to BleepingComputer, versions 3.1, 3.2, 3.3, 3.4 and 3.5 and the ISE Passive Identity Connector are affected; the fixes came with 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. There is no workaround; SecurityWeek wrote that remote exploitation can be blocked with infrastructure access control lists until the patch is applied. Cisco's product security incident response team, PSIRT, confirmed active exploitation but did not name the attacker. In the same alert CISA also added CVE-2026-87886, an incorrect default permissions flaw in Acronis Backup, to the catalogue.

The difference here lies in the product's function. ISE is the central component that determines who may reach which resource on corporate networks; its compromise means that not a single server but the entire access decision passes to the attacker. The other records of the same week point to this layer as well: the KVKK notifications record that summarised login and password information leaked at some companies, the average CVSS score of the nine vulnerabilities CloudSEK examined was calculated at 9.2, and on the Taiwanese side the agenda moved to post-quantum cryptography and authentication. The attack surface is moving from the endpoint to the identity and access layer; in that layer a single mistake renders the whole of perimeter defence meaningless. The sources diverge on dates: CISA's alert is dated 16 September, while SecurityWeek gave both the Cisco bulletin and the KEV addition as 17 September; this divergence could not be independently verified.

Türkiye: both victim and point of concentration

The largest breach on the KVKK's list occurred at Yeni Mağazacılık A.Ş., which operates the Eve Kozmetik brand: the names, surnames, email addresses and telephone numbers of 6,263,305 customers were affected. It was followed by Shaya Mağazacılık with 2,298,726 people and Deniz Deniz Butik Tekstil with 1,271,096; the rest of the list consists of smaller notifications running from 133,991 down to 695, and the figure for İnternet Tekstil has yet to be determined. The common cause standing out in the notifications is the exploitation of a vulnerability in a third-party software library. Whether these 12 incidents are part of a single campaign could not be independently verified; but the recurrence of the common cause shows that one component can expose dozens of companies at the same time.

The regional picture looks in the same direction. In CloudSEK's report covering April 2025 to 31 August 2026, Israel comes first with 7,112 records; Türkiye is second, followed by Iran, the United Arab Emirates and Saudi Arabia. 2,588 activity indicators were recorded for the UAE and 1,880 for Saudi Arabia; 37.8% of regional hacktivist activity targeted Israel. According to The National, Türkiye is first in the region in ransomware targeting; the sectors that stand out are manufacturing, construction, defence and logistics. In other words Türkiye is second in total threat volume and first in financially motivated encryption attacks. That divergence suggests attackers see Türkiye less as a political target than as an industrial network with the capacity to pay. The month of heaviest total activity was March 2026, with 2,245 records.

Defence diverges by institutional capacity

The real break is in the distribution not of the threat but of the defence. CISA imposed on federal civilian executive agencies an obligation to close the flaw within 3 days; that period comes from directive BOD 26-04 and binds federal agencies alone. For the energy, health, telecom and finance operators running the same product there is no binding timetable. The companies on the KVKK list sit at the other end of the scale: mid-sized businesses weighted towards retail and textiles, running from a 695-person notification to a 6.3 million-person notification, most of them without a security team of their own. The same class of vulnerability is met with a patching time that varies between three days and months according to institutional capacity.

On the attack side, meanwhile, the cost is falling. CloudSEK reported that MuddyWater used Google's Gemini model to develop attack tooling and that APT42 used artificial intelligence to generate phishing messages; Lin likewise said that attackers had begun using artificial intelligence to make attacks more efficient. In the UAE, daily hacking attempts rose from the pre-war level of 200,000 to about 800,000, and one attacker demanded a ransom of more than 5 million dollars from a private company. As preparation costs fall, patching costs stay fixed; the gap opens between those two curves. Taiwan is trying to close that gap at state level: vulnerability detection was discussed with OpenAI, authentication and fraud prevention with Meta, and satellite communications with Amazon. Neither source, however, mentions a binding agreement; no concrete memorandum could be independently verified.

What to watch

Three indicators are decisive. First, the number of identity and access management product flaws added to the KEV catalogue; this series will show whether CVE-2026-76460 is an isolated case or the first example of a class. Second, whether the third-party software library cause recurs in the KVKK's subsequent public announcements; if it does, the figure of 10,218,802 becomes a floor rather than a ceiling. Third, the path of the monthly regional ransomware record relative to the level of 357 in June 2026. This report gives no estimate of the direct economic cost of cyber incidents; the data that reach the public are delayed and partial.