Cisco drops another exploited zero-day, this time a perfect 10
Cisco's CVSS 10.0 CVE-2026-76460 authentication bypass in Identity Services Engine is actively exploited, granting unauthenticated attackers root command execution.
Cisco disclosed CVE-2026-76460 (CVSS 10.0), an authentication bypass in Identity Services Engine (ISE) and ISE-PIC APIs that gives unauthenticated remote attackers command execution with root privileges; CISA added it to the KEV catalog. It follows CVE-2026-76461 (CVSS 9.8), an actively exploited flaw in Cisco Secure Email Gateway and Secure Email and Web Manager disclosed days earlier. Permanent fixes ship in ISE 3.1 Patch 12 through 3.5 Patch 4; ISE 3.0 is end-of-maintenance and ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4 are available. No workaround exists, though ACLs restricting management traffic can serve as temporary mitigation.
- CVE-2026-76460 (CVSS 10.0) affects ISE and ISE-PIC regardless of configuration
- Crafted API request bypasses the web management interface with no credentials needed
- Root access lets attackers remove or conceal traces of intrusion
- No workaround; Cisco recommends log review and reimaging if compromise is suspected
- Companion batch included two more CVSS 10.0 flaws and three RCE bugs up to 9.9
- Vendors
- Cisco
- Organizations
- CISACisco PSIRT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
| CVE-2026-76461 | Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway | 9.8 | 30% | KEVPoC ×3 | KEV |
From the original article
2 min read at theregister.comISE authentication bypass under active attack just days after another Cisco zero-day sent admins scrambling to patch
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.