Cisco warns of max severity ISE zero-day exploited in attacks
Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.
CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.
- CVE-2026-76460 is an unauthenticated API authentication bypass in Cisco ISE and ISE-PIC, exploitable regardless of configuration
- Cisco PSIRT confirmed active exploitation; no workarounds exist, only fixed releases for ISE 3.1-3.5
- CISA added the flaw to the KEV Catalog and gave federal agencies three days to patch
- Cisco advises re-imaging suspect nodes, checking access.log for suspicious usernames, and reviewing firewall logs
- Cisco also patched CVE-2026-76423 and five other critical ISE flaws, none yet flagged as exploited
- CVEs
- CVE-2026-76460CVE-2026-76423CVE-2026-20176CVE-2026-20211CVE-2026-20307CVE-2026-20284CVE-2025-20337
- Vendors
- Cisco
- Products
- Cisco ISECisco ISE-PIC
- Organizations
- CiscoCISACisco PSIRT
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-20337 | Unauthenticated Injection Flaw Allows Root RCE in Cisco ISE and ISE-PIC | 10.0 | 74% | KEV | KEV |
CVE-2026-76423+4 related CVEs | Unauthenticated Administrative Access via REST API Flaw in Cisco ISE and ISE-PIC | 10.0 group max | — | ||
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.