Cisco ISE Zero-Day CVE-2026-76460 (CVSS 10.0) Exploited in Active Attacks

Cisco has warned that a new maximum-severity flaw in Identity Services Engine (ISE) is under active exploitation. Tracked as CVE-2026-76460 and scored CVSS 10.0, the bug lets an unauthenticated remote attacker bypass authentication on an API endpoint and gain unauthorized access to the device's web-based management interface.

Per Cisco's September 16, 2026 advisory, the root cause is insufficient authentication control on that API endpoint. Cisco's PSIRT says it is aware of active exploitation, though the company has not disclosed who is behind the attacks or how widespread they are.

ISE is Cisco's network access control and identity policy engine, the system many enterprises rely on to decide which devices and users get onto the network in the first place. A remote, unauthenticated bypass that can escalate to root on that system hands an attacker a foothold with visibility into network access decisions across the organization, not just one device.

The flaw affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of how the device is configured, per Cisco's advisory. The Hacker News reports that CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, requiring Federal Civilian Executive Branch agencies to patch by September 19, 2026, a short window that reflects how seriously the agency treats confirmed in-the-wild exploitation.

Cisco's advisory attributes the vulnerability to CWE-648 (incorrect use of privileged APIs) and notes it was found during the resolution of a Cisco TAC support case rather than through external disclosure. Cisco has released fixed software for every supported branch.

• ISE/ISE-PIC 3.1: fixed in 3.1 Patch 12
• ISE/ISE-PIC 3.2: fixed in 3.2 Patch 11
• ISE/ISE-PIC 3.3: fixed in 3.3 Patch 12
• ISE/ISE-PIC 3.4: fixed in 3.4 Patch 7
• ISE/ISE-PIC 3.51: fixed in 3.5 Patch 4

Release 3.0 has already reached end of software maintenance, so Cisco advises customers still on it to migrate to a supported, patched release rather than look for a fix on that branch.

Cisco says there is no workaround for CVE-2026-76460. The only mitigation is restricting management and control-plane traffic to the device using infrastructure access control lists (iACLs), and Cisco frames that as a temporary measure pending the actual upgrade.

admin#show logging application ise-kong/access.log | include dummyuser

For detection, Cisco recommends reviewing access.log on every node in a distributed deployment for suspicious usernames, using a command like the one above as an example pattern. Because a successful attacker may gain root and erase local evidence, Cisco also advises cross-checking firewall and network logs outside the device itself, looking for unexpected uploads to external IPs or downloads from suspicious sources. If malicious activity turns up, Cisco recommends re-imaging the affected nodes and restoring from a configuration backup.

CVE-2026-76460 was published as part of a larger Cisco security update on September 16, 2026 that included 77 new CVEs in total, 41 affecting ISE and 28 affecting the Secure Firewall portfolio (ASA, FTD, and FMC), per The Hacker News's roundup of the disclosure. None of the other flaws in that batch are confirmed as exploited, but several carry very high severity scores.

• CVE-2026-76423 (CVSS 10.0) and related ISE/ISE-PIC flaws covering REST API auth bypass, remote code execution, SQL injection, and XXE
• CVE-2026-20130, CVE-2026-20192 (both CVSS 10.0) among a group of ISE and ISE-PIC hardening fixes for command injection and auth bypass
• CVE-2026-20176 (CVSS 9.9) and two related ISE flaws allowing authenticated remote command execution
• CVE-2026-20322 and CVE-2026-20325 (both CVSS 9.9) among Nexus Dashboard flaws covering command injection and auth bypass

The ISE disclosure also follows closely behind CVE-2026-76461, a CVSS 9.8 flaw in AsyncOS Software for Cisco Secure Email Gateway that Cisco confirmed was already under active exploitation just days earlier.

The immediate deadline is September 19, 2026, when federal agencies must have CVE-2026-76460 patched under CISA's KEV requirements. For everyone else, the practical priority is the same: patch ISE and ISE-PIC first, since it is the flaw with confirmed exploitation, then work through the rest of the September 16 batch given how many of those bugs also allow arbitrary code execution.

Whether Cisco or Talos discloses which threat actor is behind the ISE exploitation, and whether any of the other 76 CVEs in this batch see their own exploitation reports, are the open questions to watch in the coming weeks.