Cisco patches max-severity ISE flaw, the second critical zero-day this week
Cisco emergency-patched actively exploited CVE-2026-76460 (CVSS 10.0), an unauthenticated API flaw granting root on ISE appliances; CISA added it to KEV.
92
CVE-2026-76460
Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
CISA: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
- CVSS 3.1
- 10.0 critical
- EPSS
- 76%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending.
What to do: Upgrade ISE and ISE-PIC to the fixed releases specified in Cisco's security advisory (fixed versions are not provided in the available data); because the flaw is on CISA's KEV list, federal agencies must patch or apply mitigations per BOD 26-04 timelines. Until patched, restrict access to the web-based management interface to trusted administrative networks only, verify no unintended exposure via firewalls/ACLs, and monitor for unauthenticated access attempts against the interface.
| Product | Affected |
|---|---|
| Cisco Identity Services Engine (ISE) | — |
| Cisco ISE Passive Identity Connector (ISE-PIC) | — |
Estimated exposure
large≈10,000–100,000 ISE/ISE-PIC appliance deployments worldwide, of which an estimated low thousands have internet-reachable management interfaces — Cisco ISE is one of the most widely deployed enterprise network access control and identity platforms, concentrated in large enterprises and government networks, but exploitation requires network reachability to the web management…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
KEVCISA Known Exploited Vulnerability
- Affected
- Cisco Identity Services Engine
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- cisco
- Products
- identity services engine, identity services engine passive identity connector
- Weakness
- CWE-648
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
20 storiesInfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
Cisco drops another exploited zero-day, this time a perfect 10
Cisco's CVSS 10.0 CVE-2026-76460 authentication bypass in Identity Services Engine is actively exploited, granting unauthenticated attackers root command execution.
90
Cisco Warns of Active Exploitation of Critical ISE Flaw
Cisco warns that CVE-2026-76460 (CVSS 10.0) in Identity Services Engine is actively exploited, enabling unauthenticated root access; CISA added it to KEV.
90
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco warns CVE-2026-76460 (CVSS 10.0), an unauthenticated ISE auth bypass leading to root command execution, is under active exploitation and was added to CISA's KEV.
90
Cisco alerts customers to second actively exploited zero-day in as many days
Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.
88
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco urgently patched actively exploited zero-day CVE-2026-76460 (CVSS 10.0), an ISE authentication bypass enabling root command execution; CISA added it to KEV.
88
Weekly Cybersecurity Newsletter Bulletin – Cisco and Android 0-Day, BragJack Attack, Claude Opus 5 Used to Hack OpenAI, and 20+ Stories
Actively exploited Cisco ISE and Pixel zero-days lead a week of critical flaws, PoCs, and AI-agent attacks.
86
Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks
Cisco confirms zero-day CVE-2026-76460 (CVSS 10.0) in ISE is under active exploitation, granting unauthenticated root command execution; patches released.
86
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation
Cisco says critical SD-WAN Manager zero-day CVE-2026-76504 is under active exploitation.
85
Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.
85
Cisco warns of max severity ISE zero-day exploited in attacks
Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.
84
AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460
Canada's Cyber Centre alerts on three actively exploited Cisco ISE/ISE-PIC vulnerabilities enabling unauthenticated administrative access and data tampering.
83
CVE-2026-76460: Cisco ISE Flaw Actively Exploited
CVE-2026-76460, a critical flaw in Cisco Identity Services Engine and ISE-PIC, is being actively exploited in the wild.
80
U.S. CISA adds Acronis Backup, Cisco ISE, and Google Pixel flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited flaws in Cisco ISE, Acronis Backup, and Google Pixel (CVE-2026-76460, CVE-2026-87886, CVE-2026-58704) to its KEV catalog.
80
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Weekly recap led by actively exploited Cisco ISE auth-bypass CVE-2026-76460 (CVSS 10.0), plus Plugin4Shell AI-agent RCE and KREMLIN banking malware.
78
CISA Warns of Cisco Identity Services Engine Authentication Bypass Vulnerability (CVE-2026-76460)
CISA added actively exploited Cisco ISE authentication bypass CVE-2026-76460 to its KEV catalog, urging patches by September 19, 2026.
78
Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access
Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.
78
Cisco security advisory (AV26-932)
Cisco September 2026 updates fix flaws in ASA, FTD, FMC, ISE, and Nexus Dashboard; CISA added actively exploited CVE-2026-76460 to KEV.
72