Cisco alerts customers to second actively exploited zero-day in as many days
Cisco confirmed active exploitation of CVE-2026-76460, a CVSS 10.0 ISE API authentication bypass granting root, its second zero-day patch this week.
Cisco disclosed CVE-2026-76460, exploited before patching and discovered during a technical support case, in an ISE API allowing remote unauthenticated root access; CISA quickly added it to KEV. It is the third actively exploited ISE flaw since June 2025, after CVE-2025-20337 and CVE-2025-20281. It is unrelated to CVE-2026-76461, the Secure Email Gateway zero-day disclosed days earlier. Cisco published IOCs, said no workarounds exist, and no threat actor has been attributed.
- Root access enables policy modification, credential extraction, log deletion, and lateral movement.
- Vulnerability found during a technical support case; Cisco confirms pre-disclosure exploitation.
- Third exploited ISE flaw since June 2025 alongside CVE-2025-20337 and CVE-2025-20281.
- No workarounds available; Cisco urges immediate upgrades and published IOCs.
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20281 | Unauthenticated Root RCE via API Injection in Cisco ISE and ISE-PIC | 10.0 | 98% | KEVPoC | KEV |
| CVE-2025-20337 | Unauthenticated Injection Flaw Allows Root RCE in Cisco ISE and ISE-PIC | 10.0 | 74% | KEV | KEV |
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 40% | KEVPoC ×3 | KEV |
From the original article
3 min read at cyberscoop.com
The latest zero-day has a maximum-severity rating and affects Cisco Identity Services Engine, a product hit with three actively exploited vulnerabilities since June 2025. The post Cisco alerts customers to second actively exploited zero-day in as many days appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.