Cisco Identity Services Engine Hit With Multiple Vulnerability Disclosures, Including Reported CVSS 10.0 Zero-Day

On 2026-09-18, ZDI published three Cisco ISE advisories covering authenticated RCE flaws (CVE-2026-20176, CVE-2026-20211, both CVSS 7.2) and an XXE information disclosure (CVE-2026-20235, CVSS 4.9), while Dark Reading separately reported a maximum-severity…

Four separate disclosures on 2026-09-18 affect Cisco Identity Services Engine (ISE). The Zero Day Initiative published three advisories: ZDI-26-716 (CVE-2026-20176, CVSS 7.2), a command injection flaw in the createDBLink function enabling authenticated remote code execution, with no exploitation in the wild reported; ZDI-26-717 (CVE-2026-20211, CVSS 7.2), a deserialization-of-untrusted-data flaw in AlarmMessageDiskQueue also enabling authenticated RCE, requiring valid credentials; and ZDI-26-718 (CVE-2026-20235, CVSS 4.9), an XXE vulnerability in MnTRESTLivelogService allowing authenticated remote information disclosure. Separately, Dark Reading reported CVE-2026-76460, an authentication bypass affecting API endpoint authentication in Cisco ISE rated at the maximum CVSS 10.0, which the outlet characterized as a zero-day. Sources disagree in framing: the ZDI advisories report no exploitation in the wild and are disclosure-driven, while Dark Reading labels its separate CVE a zero-day but provides no exploitation details, victim counts, or patch status. The relationship between CVE-2026-76460 and the three ZDI-tracked CVEs is not established in the available reports.