Cisco patches an ISE authentication bypass attackers used before the fix existed
CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
The Watch · Security desk
What happened
- Cisco released urgent patches on Wednesday for a critical authentication bypass in Identity Services Engine that had already been exploited in the wild as a zero-day.
- Both ISE and ISE-PIC are affected regardless of device configuration, and no workaround exists, though infrastructure access control lists restricting traffic to the appliance prevent remote exploitation.
- CISA added the zero-day to its Known Exploited Vulnerabilities catalog on Wednesday, giving federal agencies three days to patch under BOD 26-04.
Why it matters
- Who's exposed exposure Configuration hardening removes nothing from scope: every ISE and ISE-PIC node whose API can receive packets is reachable until it is patched or fronted by an access list.
- Who has to decide decision Operators have to decide between patch-in-place and rebuild using logs held off the appliance, because the on-device record is editable by anyone who already has root.
- What it costs cost Where suspicion of malicious activity exists, the work Cisco recommends is a full re-image and configuration restore of each affected node, a larger job than the upgrade.
- What it sets up precedent A same-day KEV listing with a three-day clock puts federal agencies on an emergency change schedule for an identity appliance, and everyone outside that scope faces the same active exploitation with no deadline attached.
Next story · Security · 2d ago
Exploited Cisco email gateway flaw lets a crafted attachment run commands as rootConfirmed5 publishers
Root is what makes the log check uncertain. Cisco tells administrators to review access.log for suspicious usernames on every node in a distributed deployment [10]. It also says successful exploitation can execute commands with root privileges, and that root lets an attacker hide or delete indicators of compromise [13]. The evidence file sits on the machine the intruder controls, so an empty access.log does not establish that a node is clean [17]. Cisco's advisory sends administrators off the appliance for corroboration: network logs and firewall logs, checked for unexpected uploads and downloads [14].
"The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed," Cisco said in its advisory [12]. Suspicion alone is enough to trigger the re-image.
The upgrade is a branch-by-branch exercise. Cisco lists the fixed builds as ISE and ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12 [5], one target build for each of the five supported branches [16]. An estate with nodes pinned to an older branch for compatibility has to be matched node by node.
The bypass itself is an API endpoint that does not apply sufficient authentication controls, reached by sending crafted requests that get around the web-based management interface [2][3]. Both ISE and ISE-PIC are affected however the device is set up [4].
"The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability," the company said in the advisory [6]. Cisco has not shared any information on who is behind the attacks [7]. SecurityWeek, which reported the advisory, notes that cybercriminals and state-sponsored threat actors regularly target vulnerabilities in Cisco products [8], and ran the ISE story alongside its own coverage of a root remote code execution zero-day in Cisco Secure Email Gateway also under active exploitation [11].
What to watch
- Any attribution of the ISE exploitation to a named crew or state-sponsored group, from Cisco or a third-party responder.
- Additional indicators of compromise beyond suspicious access.log usernames, which would give defenders a check the attacker cannot edit.
- Whether CISA's KEV entry is updated with exploitation detail or a revised due date for federal agencies.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence80
Perspective Coverage
10 publishers- Builder
- Builder 16%
- Operator
- Operator 74%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cisco on Wednesday released urgent patches for a critical-severity authentication bypass vulnerability in Identity Services Engine (ISE) that has been exploited in the wild as a zero-day.
- [2]
The flaw is tracked as CVE-2026-76460 with a CVSS score of 10/10 and impacts an API endpoint of the appliance, which does not apply sufficient authentication controls.
- [3]
An attacker can send crafted requests to the API and bypass the web-based management interface to gain access to the affected device.
- [4]
Both Cisco ISE and ISE Passive Identity Connector (ISE-PIC) are affected, regardless of device configuration.
- [5]
To resolve the bug, customers should upgrade to ISE or ISE-PIC versions 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12.
- [6]
"The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability," Cisco said in its advisory.
- [7]
Cisco has not shared any information on who is behind the attacks.
- [8]
SecurityWeek notes that cybercriminals and state-sponsored threat actors regularly target vulnerabilities in Cisco products.
- [9]
No workarounds exist, but using infrastructure access control lists (iACLs) to restrict traffic to the affected device prevents remote exploitation.
- [10]
To hunt for potential compromises, organizations should review 'access.log' for suspicious usernames, and for distributed deployments the logs for each node should be checked.
- [11]
SecurityWeek published the ISE advisory story alongside its own related coverage headlined "Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation".
- [12]
"The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed," Cisco said.
- [13]
Cisco warns that successful exploitation of CVE-2026-76460 can enable attackers to execute commands with root privileges, which would allow them to hide or delete indicators of compromise.
- [14]
Cross-checking network logs and firewall logs outside of the impacted device should help administrators discover potential compromises, including unexpected uploads and downloads.
- [15]
On Wednesday, CISA added the zero-day to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch it within three days, in line with BOD 26-04 requirements.
- [16]
Cisco's fix list covers five supported release branches, 3.1 through 3.5, with a different target build for each.
- [17]
Because root-level command execution allows an attacker to hide or delete indicators of compromise on the appliance, an access.log review that returns no suspicious usernames does not establish that a node is uncompromised; the off-device network and firewall logs are the independent check.
Sources
10 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCisco warns of max severity ISE zero-day exploited in attacks
1 article · September 17, 2026
- cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog
1 article · September 16, 2026
- cyberscoop.comCisco alerts customers to second actively exploited zero-day in as many days
1 article · September 17, 2026
- helpnetsecurity.comUnauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
1 article · September 17, 2026
- infosecurity-magazine.comCisco Warns of Active Exploitation of Critical ISE Flaw
1 article · September 17, 2026
- networkworld.comCisco patches max-severity ISE flaw, the second critical zero-day this week | Network World
1 article · September 19, 2026
- scworld.comCisco patches 10.0 ISE bug exploited in the wild
1 article · September 17, 2026
- securityweek.comActive Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
2 articles · September 19, 2026
- thecyberexpress.comCisco ISE Vulnerability With CVSS 10.0 Score Under Active Attack
1 article · September 18, 2026
- thehackernews.comCisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
2 articles · September 17, 2026