- The Mess: Cisco Identity Services Engine has a CVSS 10.0 authentication-bypass zero-day that attackers are already exploiting. The vulnerable API can be reached remotely without credentials, and successful exploitation can lead to root-level command execution.
- The Damage: Compromising ISE can put the system controlling enterprise network access directly under attacker control.
- The Fix: Upgrade Cisco ISE immediately to a fixed release and inspect
access.logfor signs of exploitation.
Cisco ISE just became another enterprise security appliance that cannot be treated as “just an internal management system.”
CVE-2026-76460 is a critical authentication-bypass vulnerability in an ISE API. Cisco rates it CVSS 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
No credentials.
No privileges.
No user interaction.
The attacker only needs network access to the vulnerable API endpoint.
And unlike many newly disclosed CVEs, this one is already being exploited.
Cisco’s PSIRT explicitly says it is aware of active exploitation of CVE-2026-76460.
The bug sits in authentication
The vulnerability exists because an API endpoint does not enforce authentication correctly.
An attacker can send a specially crafted request and bypass the normal web-based management authentication mechanism.
That changes the attack from:
Internet → login → authentication → management
into:
Internet → vulnerable API → unauthorized access
Cisco says successful exploitation can allow an attacker to gain unauthorized access to the affected device.
The dangerous part comes next.
Cisco warns that successful exploitation may allow threat actors to obtain command execution with root privileges.
At that point, the attacker is no longer merely abusing an API.
They own the underlying appliance.
Why Cisco ISE is a particularly nasty target
Cisco Identity Services Engine is not an ordinary web application.
ISE sits in the middle of enterprise identity and network-access enforcement.
Organizations use it for functions such as:
- user and device authentication
- network access policies
- endpoint profiling
- security posture checks
- authorization decisions
- identity-based access control
- integration with network infrastructure
Compromise therefore attacks part of the infrastructure that decides who gets onto the network and what they are allowed to access.
That makes an ISE compromise potentially more valuable than compromising an isolated application server.
An attacker who gets root access to the identity infrastructure can potentially use that position to investigate credentials, configuration, integrations and connected systems.
The exact post-exploitation activity depends on the environment, and Cisco has not publicly attributed the attacks or described a complete exploitation chain. But the root-level impact alone makes the vulnerability exceptionally serious.
Cisco ISE and ISE-PIC are affected
The problem is not limited to some unusual configuration.
Cisco states that CVE-2026-76460 affects Cisco ISE and Cisco ISE Passive Identity Connector regardless of device configuration.
That removes one of the easiest excuses for delaying remediation:
“We don’t use that feature.”
For this vulnerability, configuration does not provide a reliable escape hatch.
Cisco also states that there is no workaround that addresses the vulnerability.
An infrastructure ACL can reduce exposure, but Cisco’s recommendation is still to upgrade to a fixed release.
The exploitation is already happening
This is the part administrators should not ignore.
Cisco’s advisory explicitly says its PSIRT is aware of active exploitation.
That moves CVE-2026-76460 out of the normal vulnerability-management queue.
It is not a vulnerability that defenders should put into a spreadsheet and revisit during the next maintenance window.
It is already being used against targets.
CISA has also added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild.
The timing is particularly ugly because the disclosure is only days old.
Attackers do not need to wait for a theoretical exploit to become interesting.
Cisco is already seeing malicious use.
Cisco gave defenders an unusual gift: a hunting clue
Cisco’s advisory contains a concrete indicator that administrators can check.
The company recommends reviewing the ISE access.log and looking for suspicious usernames.
For distributed deployments, Cisco says administrators should review logs from each node.
Cisco specifically provides this command:
show logging application ise-kong/access.log | include dummyuser
Unexpected entries matching that pattern can indicate malicious activity.
That matters because simply installing the patch does not answer a more important question:
Was the appliance already compromised?
If the attacker obtained root privileges before remediation, patching the vulnerability does not automatically remove persistence or undo changes.
Root access changes the incident-response equation
Cisco warns that attackers with root-level command execution may be able to remove or hide evidence of exploitation.
That means investigators should not assume that a clean-looking appliance proves nothing happened.
For affected deployments, the sequence should be:
- Identify every ISE and ISE-PIC node.
- Record the currently installed release and patch level.
- Restrict unnecessary access to the management interface.
- Review
access.logand other relevant authentication/API logs. - Search for suspicious usernames and unexpected API activity.
- Preserve evidence before making destructive changes where possible.
- Apply the appropriate Cisco security update.
- If compromise is confirmed, follow Cisco’s recovery guidance rather than simply returning the appliance to production.
- Review credentials, integrations and privileged accounts associated with the system.
Cisco specifically says that if malicious activity is detected, affected nodes should be re-imaged and restored from configuration backup as appropriate.
That recommendation tells you how seriously Cisco views a successful exploitation event.
Fixed versions
Cisco has released fixes across supported ISE branches.
The fixed releases are:
- ISE 3.1 — Patch 12
- ISE 3.2 — Patch 11
- ISE 3.3 — Patch 12
- ISE 3.4 — Patch 7
- ISE 3.5 — Patch 4
Cisco recommends upgrading to a fixed release. There is no workaround that fully addresses CVE-2026-76460.
Organizations running older unsupported branches should not assume that a small configuration change is sufficient. The practical remediation path is migration to a supported fixed release.
This is bigger than one CVE
Cisco’s September 16 disclosure also contains a large collection of additional ISE vulnerabilities.
Several other ISE issues involve authentication bypass, REST API abuse, command execution, SQL injection and XXE. Some carry CVSS 10.0 scores.
That does not mean CVE-2026-76460 should be lumped together with all of them.
It is different because Cisco has confirmed active exploitation of this specific vulnerability.
The broader disclosure does, however, reinforce one uncomfortable fact:
Enterprise identity appliances have become high-value attack surfaces.
They sit between users, devices and network infrastructure.
Once compromised, they can provide attackers with an unusually powerful position inside the environment.
The management interface should never be Internet-friendly
Even after patching, administrators should look at exposure.
Cisco recommends using infrastructure access control lists where appropriate to permit only required management and control-plane traffic destined for the affected device.
That is not a replacement for patching.
It is an additional layer.
The basic architecture should be:
Internet
↓ blocked
External network
↓ restricted
Management network
↓ ACL
ISE
The fewer systems that can reach the management interface, the smaller the practical attack surface.
But with a confirmed remotely exploitable authentication bypass, network isolation becomes defense-in-depth rather than a fix.
Bugstoday’s take
Cisco ISE is supposed to enforce who gets access to the network.
Now its own management API can be bypassed without credentials.
That is the irony.
CVE-2026-76460 is not merely a broken login page.
It is an unauthenticated entry point into identity infrastructure, with Cisco confirming active exploitation and warning that successful attacks can reach root-level command execution.
If you operate ISE, check the version.
Then check the logs.
Then patch.
And if the logs show signs of exploitation, treat the appliance as potentially compromised rather than assuming that an upgrade magically cleans it up.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Cisco Security Advisory — CVE-2026-76460, Cisco Identity Services Engine Authentication Bypass Vulnerability.
- Cisco Security Advisory — ISE authentication bypass and related vulnerabilities.
- CISA Known Exploited Vulnerabilities Catalog — CVE-2026-76460.
- Cisco Security Hardening Release — September 2026.
