Cisco Warns of Critical ISE Zero-Day Exploited in Active Attacks

Cisco has released emergency security updates for a maximum-severity zero-day vulnerability affecting its Identity Services Engine (ISE) that is already being exploited in real-world attacks.

Tracked as CVE-2026-76460, the vulnerability carries a CVSS score of 10.0 and allows an unauthenticated remote attacker to bypass authentication on affected Cisco ISE and ISE Passive Identity Connector (ISE-PIC) systems.

Cisco says successful exploitation may ultimately provide attackers with command execution as root, giving them extensive control over the affected appliance.

CVE-2026-76460 at a Glance

How the Vulnerability Works

The flaw is caused by insufficient authentication controls on an API endpoint.

An attacker who can reach the vulnerable interface can send a specially crafted request and bypass the web-based management interface without possessing legitimate credentials.

The attack path can be summarized as:

Remote attacker → Crafted API request → Authentication bypass → Unauthorized ISE access → Potential root command execution

Root-level access is particularly serious because Cisco warns that attackers may be able to remove or hide evidence of exploitation after compromising a device.

Affected Versions and Fixes

The vulnerability affects Cisco ISE and ISE-PIC regardless of device configuration. Cisco recommends upgrading to the following fixed releases:

Cisco ISE 3.0 has reached the end of software maintenance, so customers still using it should migrate to a supported fixed release.

Active Exploitation Confirmed

Cisco's Product Security Incident Response Team (PSIRT) has confirmed that it is aware of active exploitation of CVE-2026-76460.

However, Cisco has not publicly disclosed who is conducting the attacks, how many organizations have been compromised, or what attackers are doing after gaining access.

CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on September 16, requiring U.S. Federal Civilian Executive Branch agencies to remediate it by September 19, 2026.

How to Check for Compromise

Cisco recommends reviewing:

ise-kong/access.log

for suspicious usernames.

Administrators can use:

admin#show logging application ise-kong/access.log | include dummyuser

Cisco says output from this check is likely an indication of malicious activity. In distributed ISE deployments, every node should be examined separately.

Because attackers may obtain root access and potentially remove local evidence, organizations should also correlate ISE logs with external firewall, network and security telemetry.

No Workaround Available

Cisco says there is no workaround that fully addresses CVE-2026-76460.

As a temporary mitigation, organizations can use infrastructure access control lists (iACLs) to restrict management and control-plane traffic reaching affected systems. However, this should not replace patching.

Organizations should prioritize:

• Updating every ISE and ISE-PIC node to a fixed release.
• Restricting management-interface exposure.
• Reviewing logs for evidence of exploitation.
• Checking external network telemetry for suspicious activity.
• Investigating unexpected administrative or configuration changes.
• Re-imaging affected nodes if compromise is detected.

Cisco specifically recommends re-imaging compromised nodes and restoring configuration from backup where necessary.

Security Takeaway

CVE-2026-76460 represents a serious threat because exploitation requires no authentication or user interaction, affects Cisco ISE regardless of configuration, and may ultimately give attackers root-level command execution.

With active exploitation already confirmed and no complete workaround available, organizations running Cisco ISE or ISE-PIC should treat patching as an immediate priority and perform compromise checks on previously exposed systems.