Cisco Zero-Day Highlights API Endpoint Authentication Issues

A Gateway Endpoint With No Authentication Check

Cisco has patched an actively exploited zero-day in its Identity Services Engine (ISE), the network access control platform enterprises use to enforce who and what can connect to their network. Tracked as CVE-2026-76460, the flaw carries a maximum CVSS score of 10.0 and allows a remote, unauthenticated attacker to bypass authentication entirely via a crafted request to an API endpoint.

Both Cisco ISE and ISE Passive Identity Connector (ISE-PIC) are affected, regardless of device configuration. From ISE release 3.1 onward, the Monitoring APIs, External RESTful Services (ERS) APIs, and Open APIs all route through Cisco's Kong API Gateway — and the bug is a missing authentication check on a specific endpoint sitting behind that gateway. Because every one of those API surfaces funnels through the same gateway, a bypass there effectively compromises the whole deployment: an attacker can gain unauthorized administrative access to the appliance, with the potential for complete loss of network visibility, credential theft, or manipulation of authentication policy across the entire enterprise.

Active Exploitation and Federal Deadline

Cisco has confirmed it is "aware of active exploitation of this vulnerability," though it has not disclosed details on the attackers or the nature of the observed activity. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, requiring U.S. federal civilian agencies to apply patches by September 19, 2026.

The disclosure lands just days after Cisco confirmed active exploitation of a separate critical flaw, CVE-2026-76461 (CVSS 9.8), in AsyncOS Software for Cisco Secure Email Gateway. Cisco's broader security review that produced this fix also uncovered 21 additional critical vulnerabilities across ISE/ISE-PIC, along with further flaws in its Secure Firewall line.

Remediation

There is no full workaround for CVE-2026-76460. Cisco states that infrastructure access control lists (iACLs) restricting traffic to the affected device can reduce remote exploitation risk, but the only real fix is upgrading to a patched release:

If compromise is suspected, Cisco recommends checking the access.log file on the device for suspicious usernames, and — because the exploit grants root-level access that allows attackers to delete logs to cover their tracks — also inspecting upstream network and firewall logs for unauthorized file uploads or downloads. In confirmed-compromise cases, Cisco's guidance is to re-image affected nodes and restore from a known-good configuration backup rather than trust in-place remediation.

Sources

• Dark Reading — Cisco Zero-Day Highlights API Endpoint Authentication Issues
• The Hacker News — Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
• SecurityWeek — Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day