Cisco ISE zero-day hits maximum severity

A perfect score for a gatekeeper flaw

Cisco has disclosed CVE-2026-76460, a critical authentication-bypass vulnerability in Cisco Identity Services Engine and Cisco ISE Passive Identity Connector, with a CVSS 3.1 base score of 10.0 [1]. The advisory was first published on September 16, 2026, at 16:00 GMT, and Cisco marked it as final in version 1.0 [1]. More importantly for defenders, Cisco’s Product Security Incident Response Team said it is aware of active exploitation of the vulnerability [1].

The flaw sits in an API endpoint and is caused by insufficient authentication control, according to Cisco [1]. A remote attacker does not need credentials, local access, or user interaction; exploitation requires sending a crafted request to an affected API endpoint [1]. If successful, the attacker can bypass the web-based management interface and gain unauthorized access to the affected device [1]. That combination explains the maximum severity rating: the vulnerable component is network reachable, the attack complexity is low, privileges are not required, and Cisco’s CVSS vector records high confidentiality, integrity, and availability impact [1].

This is not a theoretical scoring exercise. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, citing evidence of active exploitation [3]. The agency’s alert also warned that this class of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risk to the federal enterprise [3]. For U.S. federal civilian agencies, the KEV listing turns the advisory into an operational deadline rather than a recommendation; CISA’s catalog entry sets a September 19, 2026 due date for required action [5].

Why Cisco ISE makes the blast radius different

The product affected here is central to how many organizations decide who and what gets access to internal resources. Cisco ISE is described in current reporting as a centralized policy platform used to manage endpoints, users, and device access, often in environments enforcing Zero Trust models [2]. In plain terms, it helps act as the bouncer for enterprise network access. When the bouncer can be bypassed, the incident is not confined to a single application login page.

Cisco says the vulnerability affects Cisco ISE and Cisco ISE-PIC regardless of device configuration [1]. That detail matters because administrators cannot assume that a safer-looking configuration, disabled feature, or limited deployment mode removes exposure [1]. The vendor also says there are no workarounds that address the vulnerability, and it has released software updates as the remediation path [1]. Current reporting underlines the same point: because no workaround exists, applying the relevant security updates is the recommended course of action for protection against ongoing attacks [2].

The situation is more serious because successful exploitation may lead to command execution with root privileges [1]. Cisco warns that this level of access could let threat actors remove or hide evidence of exploitation and indicators of compromise [1]. That turns incident response into a two-track job: patch the software, but also assume that the appliance’s own evidence may be incomplete if an attacker already landed on it.

Fixed releases and unsupported versions

Cisco lists fixed releases for each supported Cisco ISE or ISE-PIC branch affected by CVE-2026-76460 [1]. The first fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 [1]. Cisco also notes that ISE Software Release 3.0 has reached end of software maintenance, and customers on that release should migrate to a supported release that includes the fix [1].

This is the practical heart of the advisory. Security teams should first identify every ISE and ISE-PIC node, including nodes in distributed deployments, confirm the running version and patch level, and map each one to Cisco’s fixed-release table [1]. If any node is still exposed on an affected build, the risk is not merely “critical”; it is an actively exploited, unauthenticated entry point into a system that enforces access policy [1][3].

Cisco’s advisory also belongs to a wider September 16 security publication cycle, and current reporting notes that Cisco released fixes for numerous critical vulnerabilities across its portfolio that day [4]. Still, CVE-2026-76460 stands out because Cisco and CISA both identify exploitation in the wild [1][3]. Other critical bugs may compete for patching windows, but this one has evidence of live attacker activity attached to it [3].

What defenders should look for now

Cisco’s immediate forensic guidance starts with access logs [1]. Administrators should review the access.log file for suspicious usernames, and if the device is part of a distributed deployment, they should review logs from each node [1]. Cisco gives a non-exhaustive example using the ISE Kong access log and a suspicious username search pattern [1]. The company says the presence of any matching output may indicate malicious activity [1].

The important caveat is that local evidence may not tell the whole story. Cisco warns that attackers who obtain root-level command execution may be able to remove or hide exploitation traces [1]. Because of that, Cisco strongly recommends cross-checking network logs and firewall logs outside the impacted device, including looking for unexpected uploads from the affected device to external IP addresses or downloads from malicious IP addresses [1]. Current reporting similarly emphasizes that external logs are needed because post-exploitation root access could let intruders cover their tracks on the appliance itself [2].

If malicious activity is suspected, Cisco strongly recommends re-imaging the affected nodes and restoring from configuration backup if needed [1]. That recommendation is significant: it treats the appliance as potentially untrustworthy after exploitation, not merely as a host that can be cleaned with a quick file deletion or service restart [1]. For distributed ISE deployments, the same logic should apply node by node, because Cisco says log review should be performed on every node in the deployment [1].

Temporary exposure reduction is not a substitute for patching

Cisco states there are no workarounds for CVE-2026-76460 [1]. However, current reporting notes Cisco’s mitigation guidance that infrastructure access control lists can be used to restrict management and control-plane traffic destined for affected systems [4]. That distinction is important. Filtering who can reach management interfaces can reduce exposure, but it does not fix the vulnerable code path and should not be treated as equivalent to an upgrade [1][4].

For organizations that cannot patch instantly, the minimum defensible posture is to narrow access to ISE management and relevant API surfaces, validate that no affected node is reachable from unnecessary networks, and accelerate change approval for the fixed release [4]. But because exploitation is already active, exposure reduction should buy hours, not weeks [1][3]. The patch decision should be governed by compromise likelihood and business impact, not by a normal maintenance calendar.

CISA’s action reinforces that point. The agency added CVE-2026-76460 to KEV based on active exploitation and tied remediation to risk-based vulnerability management requirements for federal civilian agencies [3]. Although CISA’s directive applies to those agencies, the agency encourages all organizations to prioritize remediation of KEV-listed vulnerabilities [3]. In this case, private-sector defenders should read that as a clear prioritization signal.

The bottom line

CVE-2026-76460 is a worst-case category of enterprise infrastructure bug: unauthenticated, remote, maximum severity, actively exploited, and located in a platform used to enforce access policy [1][3]. Cisco has published fixed releases, but no workaround, and it has warned that successful exploitation may give attackers root-level command execution and the ability to hide evidence [1]. That makes the response sequence clear: inventory every ISE and ISE-PIC node, patch to the fixed branch, restrict management-plane exposure, review every node’s access logs, cross-check external network and firewall telemetry, and re-image systems where compromise is suspected [1][2][4].

The firewall may stop plenty of fights, but in this incident the gatekeeper itself is in the boss battle. Treat it accordingly.

Sources from the last 72 hours

1. [1]Cisco Identity Services Engine Authentication Bypass VulnerabilitySep 16, 2026, 4:00 PM UTC
2. [2]Cisco warns of max severity ISE zero-day exploited in attacksSep 17, 2026, 12:00 AM UTC
3. [3]CISA Adds Two Known Exploited Vulnerabilities to CatalogSep 16, 2026, 12:00 AM UTC
4. [4]Cisco drops another exploited zero-day, this time a perfect 10Sep 17, 2026, 1:40 PM UTC
5. [5]KEV Entry: CVE-2026-76460Sep 16, 2026, 7:00 PM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.