Cisco Warns of Active Exploitation of Critical ISE Flaw
Cisco warns that CVE-2026-76460 (CVSS 10.0) in Identity Services Engine is actively exploited, enabling unauthenticated root access; CISA added it to KEV.
Cisco disclosed CVE-2026-76460, a CVSS 10.0 flaw caused by insufficient control of an API endpoint in Cisco ISE and ISE-PIC, allowing crafted requests to bypass the web-based management interface and potentially obtain root command execution. Active exploitation is confirmed; patches are available and no workarounds exist, though infrastructure access control lists can restrict management traffic as an interim measure. CISA added the flaw to its Known Exploited Vulnerabilities catalog, requiring FCEB agencies to prioritize patching. Cisco urges checking access.log on every node, reimaging suspected compromised nodes, and reviewing external firewall logs for unexpected uploads.
- Actively exploited maximum-severity flaw in Cisco ISE and ISE-PIC
- Affects all device configurations; no workarounds, only iACL mitigation
- CISA KEV listing obligates federal civilian agencies to patch promptly
- Root-level access lets attackers erase forensic evidence on nodes
- Cisco advises reimaging and restoring from known-good backups if compromised
- CVEs
- CVE-2026-76460
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
From the original article
2 min read at infosecurity-magazine.com
Cisco urged ISE customers to apply a software update, as well as check for signs of exploitation
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.