buildOne report1 publisher Cisco patches a CVSS 10.0 ISE bypass that reaches root through its gateway-fronted management API
Cisco rated a flaw in Identity Services Engine's management API CVSS 10.0 because one crafted, unauthenticated request could reach root. A dev.to analysis traces the likely gap to route coverage in the Kong-derived gateway that authenticates the API, a risk any proxy-authenticated service shares.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence55
CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
Perspective Coverage
10 publishers
- Builder
- Builder 16%
- Operator
- Operator 74%
- Investor
- Investor 10%
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence80
buildOne report1 publisher Exploited Cisco ISE flaw gives unauthenticated attackers root on the node that grants network access
Cisco confirmed attackers are exploiting CVE-2026-76460, a CVSS 10.0 flaw giving unauthenticated root on Identity Services Engine. ISE decides which devices join the network, so a rooted node hands over every access decision and the device credentials it stores.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher F5 and Cisco report live exploitation in two of the three security products Canada's Cyber Centre flagged
F5 and Cisco say attackers are exploiting flaws in BIG-IP APM and ISE, two of the three security products in Canada's September 2026 Cyber Centre alerts. Three alerts are too few to show a trend in attacker targeting, but the two exploited products need fixed software now.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence50
Eclypsium finds the month's exploited infrastructure flaws again in the management consoles
Eclypsium tracked 158 infrastructure advisories between August 25 and September 17. The exploited maximum-severity flaws it highlights are authentication bypasses in Cisco's Firewall Management Center and Identity Services Engine.
Reality
- Evidence62
- Adoption72
- Hype gap+14
- Incentives65
- Confidence58
Attackers are bypassing authentication on Cisco ISE with a crafted API request
Cisco says CVE-2026-76460 is under active exploitation. It scores 10.0, needs no credentials, and puts an unauthenticated attacker past the web management interface of an Identity Services Engine appliance.
Reality
- Evidence45
- Adoption30
- Hype gap−10
- Incentives50
- Confidence48
Attackers hit Cisco's email gateway with a SQL injection zero-day before the patch shipped
CVE-2026-76461 is one of three flaws confirmed under active attack in a single week. Revolut's customer records left by a different route, a request sent from an email address on a government agency's own domain.
Reality
- Evidence42
- Adoption62
- Hype gap+12
- Incentives58
- Confidence47
buildConfirmed2 publishers Cisco's PSIRT says CVE-2026-76460 is being exploited, and the company has published no workaround, so the fix is a branch-specific patch. ISE 3.0 is past End of Software Maintenance and gets a migration.
Reality
- Evidence72
- Adoption42
- Hype gap+6
- Incentives38
- Confidence68
buildOne report1 publisher A crafted HTTP request runs commands as root on unpatched Cisco ISE nodes
Cisco and CISA confirm CVE-2026-76460 is being exploited in the wild. The flaw sits in the ISE and ISE-PIC management API, scores 10.0, and affects vulnerable releases whatever optional features are turned on.
Reality
- Evidence62
- Adoption52
- Hype gap0
- Incentives30
- Confidence58
buildOne report1 publisher A CVSS 10.0 bypass hands ISE admin access to anyone who can route to the REST API
Cisco disclosed an unauthenticated authorization bypass in the Identity Services Engine REST API on 16 September. Because the request never presents a credential, it leaves just one trace: a privileged API call that succeeded.
Reality
- Evidence45
- Adoption30
- Hype gap+18
- Incentives52
- Confidence58
Cisco Patches 44 CVEs Across ISE, FMC, Nexus Dashboard; Separately Warns of Exploited ISE Authentication Bypass Zero-Day
Twelve of the 20 Identity Services Engine CVEs Cisco fixed on September 16 are critical and three were public before the patch, but all three need an administrator account, so the queue starts elsewhere.
Reality
- Evidence58
- Adoption52
- Hype gap−10
- Incentives40
- Confidence62