Research instrument / 01
Explore affected-country patterns across the historical record. Country markers use reference coordinates; every count belongs to the stated dataset and period.
Loading documented country records…
Pin up to two country profiles to compare their history.
EuRepoC v1.3.2 contains 3,414 source rows, with 3,152 incidents mapped to 4,542 country placements. Geography is the receiver’s country, not an attacker’s location. A year filter uses recorded incident start year; examples remain labelled with their own source dates. Counts reflect this corpus’s inclusion criteria, not total global activity.
Dataset & license ↗Search CISA’s Known Exploited Vulnerabilities catalog. An entry identifies a vulnerability with reported exploitation; it does not identify victims or attack locations.
Cisco’s disclosure for CVE-2026-76460 states that an unauthenticated remote attacker can bypass authentication through an ISE API. Cisco reports active exploitation; this is not evidence that a particular organization was affected. Use the controls below as vendor guidance, and distinguish published advisory facts from items that remain unknown or independently unverified.
Identify ISE and ISE-PIC nodes, record release train and patch, management-plane reachability, business owner and change authority. Cisco’s advisory says both products are affected regardless of configuration.
Decision prompt: which nodes are exposed, and who owns each?Cisco says no workaround is available. It describes infrastructure ACLs that permit only required management/control-plane traffic to affected devices as temporary mitigation until upgrade. Coordinate changes with service and safety owners.
Decision prompt: does the restriction reduce reachability without breaking required service?Review ise-kong/access.log on every node; the vendor’s example username is explicitly non-exhaustive, not a standalone indicator. Use a support bundle with debug logs and shared-key encryption to inspect API-gateway logs, then correlate external firewall/network telemetry.
Cisco lists Cisco ISE and ISE Passive Identity Connector as affected regardless of configuration. Its advisory reports active exploitation, but does not identify a first-exploitation date, threat actor, victim count or confirmed data access. Exploitation status and victim attribution are separate evidence questions.
Confirmed in Cisco advisory: no workaround; required-traffic infrastructure ACLs are temporary mitigation; upgrade to a fixed release. Review ise-kong/access.log across every node; Cisco marks its sample username as non-exhaustive. For more logs, collect debug logs with shared-key encryption and inspect the decrypted support bundle. Correlate external firewall/network telemetry because root-level access could allow evidence to be hidden. Cisco recommends re-imaging nodes and restoring configuration backup when malicious activity is suspected.
Limits of this account: CISA catalog due date, exact required-action text, ransomware/forensic fields; community rules and honeypot endpoints; actor, victim, and first-exploitation claims.