Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation
Cisco says critical SD-WAN Manager zero-day CVE-2026-76504 is under active exploitation.
85
Product
Cisco Identity Services Engine
- Mentions · 7d0
- Mentions · 30d1
- All mentions36
- First seenAug 13, 2026
- Last mentioned29d ago
Timeline
36 articles · newest firstInfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
Week in review: Cisco patches exploited email gateway 0-day, Revolut breach
Weekly roundup: Cisco patches actively exploited email gateway zero-day CVE-2026-76461, Revolut discloses breach via government-agency impersonation, plus Acronis, Parallels, Cisco ISE flaws.
30
Cisco Zero-Day Highlights API Endpoint Authentication Issues
Cisco ISE zero-day CVE-2026-76460 is a maximum-severity (CVSS 10.0) authentication bypass affecting API endpoint authentication.
70
ZDI-26-717: Cisco Identity Services Engine AlarmMessageDiskQueue Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-20211, an authenticated deserialization flaw (CVSS 7.2) enabling remote code execution in Cisco Identity Services Engine.
25
ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability
ZDI detailed CVE-2026-20235, an authenticated XML external entity information disclosure flaw (CVSS 4.9) in Cisco Identity Services Engine.
20
ZDI-26-716: Cisco Identity Services Engine createDBLink Command Injection Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-20176, an authenticated command injection flaw enabling remote code execution in Cisco Identity Services Engine, rated CVSS 7.2.
48
Cisco patches max-severity ISE flaw, the second critical zero-day this week
Cisco emergency-patched actively exploited CVE-2026-76460 (CVSS 10.0), an unauthenticated API flaw granting root on ISE appliances; CISA added it to KEV.
92
Cisco alerts customers to second actively exploited zero-day in as many days
Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.
88
AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460
Canada's Cyber Centre alerts on three actively exploited Cisco ISE/ISE-PIC vulnerabilities enabling unauthenticated administrative access and data tampering.
83
Cisco security advisory (AV26-932)
Cisco September 2026 updates fix flaws in ASA, FTD, FMC, ISE, and Nexus Dashboard; CISA added actively exploited CVE-2026-76460 to KEV.
72
CISA Warns of Cisco Identity Services Engine Authentication Bypass Vulnerability (CVE-2026-76460)
CISA added actively exploited Cisco ISE authentication bypass CVE-2026-76460 to its KEV catalog, urging patches by September 19, 2026.
78
CVE-2026-76460: Cisco ISE Flaw Actively Exploited
CVE-2026-76460, a critical flaw in Cisco Identity Services Engine and ISE-PIC, is being actively exploited in the wild.
80
Cisco drops another exploited zero-day, this time a perfect 10
Cisco's CVSS 10.0 CVE-2026-76460 authentication bypass in Identity Services Engine is actively exploited, granting unauthenticated attackers root command execution.
90
Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard
Cisco patches dozens of critical flaws in FMC, ISE and Nexus Dashboard, including ISE bugs and an authentication bypass already exploited in the wild.
80
Cisco Warns of Active Exploitation of Critical ISE Flaw
Cisco warns that CVE-2026-76460 (CVSS 10.0) in Identity Services Engine is actively exploited, enabling unauthenticated root access; CISA added it to KEV.
90
Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks
Cisco confirms zero-day CVE-2026-76460 (CVSS 10.0) in ISE is under active exploitation, granting unauthenticated root command execution; patches released.
86
Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.
85
U.S. CISA adds Acronis Backup, Cisco ISE, and Google Pixel flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited flaws in Cisco ISE, Acronis Backup, and Google Pixel (CVE-2026-76460, CVE-2026-87886, CVE-2026-58704) to its KEV catalog.
80
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Cisco warns CVE-2026-76460 (CVSS 10.0), an unauthenticated ISE auth bypass leading to root command execution, is under active exploitation and was added to CISA's KEV.
90
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco urgently patched actively exploited zero-day CVE-2026-76460 (CVSS 10.0), an ISE authentication bypass enabling root command execution; CISA added it to KEV.
88
Cisco Identity Services Engine Information Disclosure Vulnerability
Cisco patched an ISE API flaw letting an authenticated administrator view sensitive data including hashed credentials via crafted API requests.
25
Cisco Identity Services Engine SQL Injection Vulnerabilities
Cisco released fixes for multiple SQL injection vulnerabilities in Identity Services Engine as part of its September 2026 advisory batch.
28
Cisco Identity Services Engine Multiple Path Traversal Vulnerabilities
Cisco ISE and ISE-PIC contain multiple path traversal vulnerabilities allowing remote attacks; fixes released with no workarounds available.
30
Cisco Identity Services Engine Hardening Release: September 2026
Cisco ISE hardening release fixes multiple internally discovered vulnerabilities, including an authentication bypass known to be actively exploited.
58
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
Cisco patched a reflected XSS in the ISE management interface allowing unauthenticated attackers to execute script via crafted links.
25
Cisco Identity Services Engine 802.1X Session Hijack and Information Disclosure Vulnerabilities
Cisco patched Identity Services Engine flaws letting unauthenticated local attackers bypass 802.1X authentication or disclose sensitive information.
30
Cisco Identity Services Engine Command Injection Vulnerabilities
Authenticated attackers with admin credentials could exploit Cisco ISE command injection flaws to execute arbitrary commands as root; fixes released.
30
Cisco Identity Services Engine Authentication Bypass Vulnerabilities
Cisco fixed multiple authentication bypass flaws in Identity Services Engine and ISE-PIC enabling remote data access, manipulation, and certificate material disruption.
38
Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities
Cisco fixed multiple authenticated SQL and HQL injection flaws in Identity Services Engine and ISE-PIC APIs allowing arbitrary database queries and unauthorized data access.
30
Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
Cisco patched a RADIUS flaw in Identity Services Engine letting unauthenticated remote attackers trigger denial of service on ISE nodes.
35
Cisco Advance Notification for Publication of September 16, 2026, Security Advisories
Cisco will publish security advisories with fixed software on September 16, 2026, covering BroadWorks, ISE, Nexus Dashboard, ASA, FMC, FTD and ThousandEyes.
18
ZDI-26-582: Cisco Identity Services Engine PatchUpdateListener Directory Traversal Information Disclosure Vulnerability
Cisco Identity Services Engine's PatchUpdateListener has an authenticated directory traversal (CVE-2026-20148, CVSS 4.9) enabling sensitive information disclosure.
20
ZDI-26-579: Cisco Identity Services Engine zipFiles Directory Traversal Remote Code Execution Vulnerability
ZDI disclosed an authenticated directory traversal flaw (CVE-2026-20181) in Cisco Identity Services Engine allowing remote code execution, CVSS 7.2.
30
ZDI-26-581: Cisco Identity Services Engine invokeScript Command Injection Remote Code Execution Vulnerability
ZDI details CVE-2026-20147, an authenticated command injection in Cisco Identity Services Engine allowing remote code execution, rated CVSS 7.2.
38
ZDI-26-580: Cisco Identity Services Engine Missing Authentication for Critical Function Information Disclosure Vulnerability
ZDI discloses CVE-2026-20190, a missing-authentication flaw in Cisco Identity Services Engine permitting unauthenticated sensitive information disclosure, rated CVSS 7.5.
38
Related CVEs
by mentions- CVE-2026-7646076%10.0Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
- CVE-2026-7646130%9.8Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway
- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-2031635%5.3Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
- CVE-2026-2019210.0Critical Improper Access Control Flaws in Cisco ISE and ISE-PIC
- Authenticated SQL Injection in Cisco ISE SXP REST API
- Authenticated Command Injection in Cisco Identity Services Engine (ISE)
- Authenticated Java Deserialization RCE in Cisco Identity Services Engine (ISE)
- Authenticated OS command injection (RCE) in Cisco ISE IPsec Open API
- Authenticated OS Write-Access Flaw in Cisco Identity Services Engine
Appears with
- Ciscovendor · 35
- Cisco ISE Passive Identity Connectorproduct · 13
- Ciscoorganization · 12
- CISAorganization · 8
- Zero Day Initiativevendor · 6
- CISAvendor · 5
- Zero Day Initiativeorganization · 4
- Cisco Secure Firewall Management Centerproduct · 4
- Cisco Nexus Dashboardproduct · 3
- Cisco PSIRTorganization · 3
- Cisco Secure Firewall Threat Defenseproduct · 3
- Cisco Secure Email Gatewayproduct · 3
- Acronisvendor · 2
- Cisco Secure Firewall Adaptive Security Applianceproduct · 2
- Canadian Centre for Cyber Securityvendor · 2
- ISE Passive Identity Connectorproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.