Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

A Maximum-Severity Bypass at the Network's Front Door

Cisco shipped emergency patches on September 16, 2026, for a maximum-severity zero-day in its Identity Services Engine (ISE) — the appliance many enterprises rely on for network access control, authentication policy, and device posture checks. Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation of the flaw, now tracked as CVE-2026-76460, before the fix was available. The vulnerability carries the maximum possible CVSS score of 10.0, and remote, unauthenticated attackers can exploit it to bypass authentication entirely via crafted requests to an affected API endpoint.

Unlike a typical credential-theft or phishing-driven compromise, this bug requires nothing from a victim user at all — an attacker only needs network reachability to the ISE management interface.

Incident Overview

What Cisco Has Said

Cisco's advisory states plainly: "The Cisco PSIRT is aware of active exploitation of this vulnerability." The company has not disclosed attribution, scale, or specific indicators of compromise associated with the ongoing attacks. Cisco describes the root cause as insufficient authentication control on an ISE API endpoint — a crafted request to that endpoint lets an unauthenticated attacker bypass the web-based management interface outright and gain access to the device.

Coverage of the disclosure also notes that successful exploitation can escalate to command execution with root privileges, which would let an attacker hide or delete indicators of compromise on the box itself — meaning defenders should not treat patching alone as proof no intrusion occurred, and should cross-check external network and firewall logs (not just device-local logs) for signs of prior access.

This patch is part of a broader September 2026 ISE hardening release. Alongside CVE-2026-76460, Cisco disclosed a second maximum-severity authentication-bypass flaw, CVE-2026-76423, plus several other critical-rated issues in ISE and ISE-PIC in the same batch — none of the others have (as of publication) been flagged as actively exploited, but organizations patching one should patch all of them in the same maintenance window rather than making two trips.

It's also worth noting this isn't ISE's first walk through the KEV catalog: in July 2025, attackers exploited a separate maximum-severity ISE zero-day, CVE-2025-20337, for remote code execution, deploying a custom web shell disguised as a legitimate ISE component ("IdentityAuditAction"). ISE's position as an authentication chokepoint keeps making it a high-value target.

Note: this is a distinct issue from the actively exploited SQL injection in Cisco Secure Email Gateway (CVE-2026-76461), which Cisco disclosed just days earlier on September 14-15, 2026. Different product, different bug, same vendor, same week.

CISA's Response

CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026 — the same day as Cisco's advisory — which under Binding Operational Directive 26-04 gives Federal Civilian Executive Branch (FCEB) agencies an unusually tight three-day window, through September 19, 2026, to apply the fix. A compressed deadline like that is CISA's way of signaling how favorable the exploitation profile is: no credentials, no user interaction, and a device that sits directly in the authentication path for the rest of the network.

Why This Matters

ISE isn't just another appliance — it's the policy engine that decides which devices and users get onto the network in the first place, and it often holds trust relationships with switches, wireless controllers, firewalls, and directory services across an entire environment. An authentication bypass at that layer doesn't stay contained to "one box got popped." A compromised ISE deployment can be used to manipulate network access policy, harvest authentication data flowing through the platform, or serve as a pivot point into segments that were otherwise walled off precisely because ISE was the thing enforcing the wall.

Combined with a perfect 10.0 CVSS score, confirmed real-world exploitation, no available workaround, and precedent from ISE's 2025 zero-day being used for durable footholds, this should be treated as an emergency-patch event rather than something that waits for a routine change window.

What To Do Now

1. Patch immediately to the fixed release for your branch — 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. There is no workaround, only mitigation.
2. If patching can't happen immediately, restrict access to the ISE management interface with infrastructure ACLs (iACLs) as a stopgap — not a substitute for patching.
3. Hunt for compromise before and after patching: review external firewall and network logs (not just on-device logs, since root access could let an attacker scrub those) for unexpected administrative access or unusual data transfers involving ISE.
4. Patch the sibling advisories in the same maintenance window, including CVE-2026-76423 and the other critical issues from this ISE/ISE-PIC hardening release, rather than treating CVE-2026-76460 as a one-off.
5. Federal agencies: confirm remediation against the CISA KEV deadline of September 19, 2026 under BOD 26-04.

References

• SecurityWeek — Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
• The Hacker News — Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
• BleepingComputer — Cisco warns of max severity ISE zero-day exploited in attacks
• Cisco Security Advisory — Cisco Identity Services Engine Authentication Bypass Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5)
• CISA — Known Exploited Vulnerabilities Catalog