Cisco is warning that a new maximum-severity zero-day in Identity Services Engine (ISE) is already being exploited in the wild, giving unauthenticated remote attackers a way to fully bypass authentication on the platform. The flaw, tracked as CVE-2026-76460 and rated a perfect CVSS score of 10.0, was disclosed alongside a large September patch batch and is the most severe item in that release — Cisco's Product Security Incident Response Team says it confirmed active exploitation and discovered the bug while resolving a Technical Assistance Center support case.
The Vulnerability
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-76460 |
| CVSS Score | 10.0 (Critical/Maximum) |
| Attack Vector | Network, remote, unauthenticated |
| Authentication | None required |
| Impact | Full authentication bypass; root-level command execution |
| Exploitation Status | Actively exploited in the wild (confirmed by Cisco) |
According to Cisco's advisory, the issue "is due to insufficient authentication control on an API endpoint." An attacker can send a crafted request to that endpoint and gain unauthorized access to the affected device by bypassing its web-based management interface entirely — no credentials needed. Cisco says successful exploitation can escalate to command execution with root privileges, which would let an intruder tamper with or delete indicators of compromise on the box. The vulnerability affects Cisco ISE and ISE Passive Identity Connector (ISE-PIC) regardless of device configuration.
Active Exploitation
Cisco has confirmed active exploitation of CVE-2026-76460 but has not disclosed who is behind the attacks, how long the campaign has been running, or what attackers have done after gaining access. The company says it identified the flaw while investigating a customer support case, which points to real-world attack activity surfacing the bug rather than a researcher disclosure. Cisco is advising customers to treat any sign of exploitation as a potential full compromise: because the flaw can lead to root-level access, the company recommends re-imaging affected devices and restoring from a known-good backup if compromise is suspected, rather than trusting in-place remediation alone.
This is not the first time ISE has been targeted this way. In July 2025, attackers exploited a separate maximum-severity Cisco ISE zero-day, CVE-2025-20337, in remote code execution attacks that deployed a custom web shell disguised as a legitimate ISE component. CVE-2026-76460 arrives in the same window as another actively exploited critical flaw, CVE-2026-76461 (CVSS 9.8) in AsyncOS Software for Cisco Secure Email Gateway, and as part of a broader disclosure batch of 77 new CVEs, of which 41 affect ISE and 28 affect the Secure Firewall portfolio.
Why This Is Critical
Cisco ISE is core network access control infrastructure for many enterprises — it is the system that decides which devices and users are allowed onto the network via 802.1X, profiling, and posture policies. An unauthenticated attacker who can fully bypass authentication on ISE does not just compromise one application; they gain control over the system that governs trust for the entire network. Combined with root-level command execution, that means an attacker could potentially manipulate access policies, harvest credentials and network topology data, pivot into segmented environments that ISE is meant to protect, and erase evidence of the intrusion along the way. A CVSS 10.0 score reflects that combination of zero required privileges, zero required user interaction, and maximum impact to confidentiality, integrity, and availability.
Mitigation
Cisco has published fixed releases and is urging immediate patching:
- ISE 3.1: Patch 12
- ISE 3.2: Patch 11
- ISE 3.3: Patch 12
- ISE 3.4: Patch 7
- ISE 3.51: Patch 4
Customers still running ISE 3.0 have no fix available for that branch, since it has reached end of software maintenance; Cisco says those deployments must migrate to a supported release. Cisco states there is no workaround that fully closes the vulnerability, but using infrastructure access control lists (iACLs) to restrict management-plane traffic to affected devices can prevent remote exploitation until a patch is applied.
To check for prior exploitation attempts, Cisco recommends reviewing the access log on every node in a deployment for suspicious usernames, for example:
show logging application ise-kong/access.log | include dummyuser
Any matching entry may indicate malicious activity and should be investigated as a potential compromise.
CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, which sets a patching deadline of September 19, 2026 for U.S. Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive 22-01. Organizations outside the federal mandate should treat that same short window as the practical patching target given confirmed in-the-wild exploitation.