Table of Contents
- Introduction
- What Is Cisco ISE?
- The Vulnerability: CVE-2026-76460
- Active Exploitation Confirmed
- Fixed Releases: What to Upgrade To
- Indicators of Compromise and Hunting Guidance
- CISA Adds CVE-2026-76460 to KEV Catalog
- Other Cisco ISE Flaws Patched This Week
- A History of Cisco ISE Exploitation
- What Businesses Should Do
- Final Thoughts
Introduction
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild.
The security flaw — tracked as CVE-2026-76460 — lets remote attackers bypass authentication by exploiting a weakness in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of configuration.
This is a maximum-severity vulnerability under active exploitation. Cisco has confirmed there are no workarounds — applying the security updates is the only recommended course of action.
This blog is based on reporting by Sergiu Gatlan (September 17, 2026).
What Is Cisco ISE?
Cisco ISE is a centralized policy platform that IT administrators use to manage endpoints, users, and device access to network resources, often while enforcing Zero Trust security models.
Because ISE sits at the center of network access control, a compromise can have serious downstream consequences. An attacker who bypasses ISE authentication can potentially:
- Gain unauthorized network access — Connecting devices or users that should be blocked
- Bypass Zero Trust controls — Undermining the policy engine that enforces them
- Move laterally — Using ISE as a foothold to reach other systems
- Escalate to root — Potentially obtaining command execution with root privileges
Cisco ISE and ISE-PIC are widely deployed in enterprises, government agencies, and healthcare organizations — anywhere network access control is required.
The Vulnerability: CVE-2026-76460
Cisco described the flaw in its advisory:
"This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface."
— Cisco| Attribute | Detail |
|---|---|
| CVE ID | CVE-2026-76460 |
| Severity | Maximum (Critical) |
| Type | Authentication bypass |
| Affected products | Cisco ISE and Cisco ISE-PIC |
| Attack vector | Remote, crafted request to an API endpoint |
| Configuration dependent | No — affects all configurations |
| Workarounds | None available |
| Exploited in the wild | Yes — confirmed by Cisco PSIRT |
Active Exploitation Confirmed
Cisco warned customers on Wednesday to secure their systems since its Product Security Incident Response Team (PSIRT) flagged CVE-2026-76460 as actively exploited.
"The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."
— Cisco PSIRTBecause no workarounds exist, applying the security updates is the only recommended course of action to protect networks from ongoing attacks.
Fixed Releases: What to Upgrade To
Cisco has published fixed releases for all supported branches of ISE and ISE-PIC:
| Cisco ISE or ISE-PIC Release | First Fixed Release |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
If you run any supported ISE branch, a fixed release is available. Upgrade immediately — there is no workaround to buy time.
Indicators of Compromise and Hunting Guidance
Cisco shared indicators of compromise and advised security teams to look for suspicious usernames in access.log files on every node.
The company "strongly" recommended re-imaging the nodes and restoring them from backups if malicious activity is suspected.
Attackers may remove evidence of exploitation after obtaining command execution with root privileges. This makes thorough log review across all nodes essential.
Admins should also cross-check firewall and network logs for signs of suspicious activity, including:
- Downloads from external or malicious IP addresses
- Uploads to external or malicious IP addresses
- Suspicious usernames in
access.logon every ISE node - Evidence of root-level command execution
- Unexplained configuration changes on ISE appliances
If you suspect compromise, do not simply patch and move on. Re-image the nodes and restore from a known-good backup — attackers with root access may have left persistent backdoors.
CISA Adds CVE-2026-76460 to KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) also ordered federal agencies to patch their systems against CVE-2026-76460 within three days after adding it to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday.
A three-day remediation window is among the shortest CISA mandates. It signals that the agency considers this vulnerability an immediate, high-impact threat to federal networks.
Other Cisco ISE Flaws Patched This Week
Yesterday, Cisco patched a second maximum-severity authentication bypass flaw (CVE-2026-76423) and five other critical security issues in Cisco ISE and Cisco ISE-PIC:
- CVE-2026-76423 — Second max-severity authentication bypass
- CVE-2026-76460 — The actively exploited bypass
- CVE-2026-20176
- CVE-2026-20211
- CVE-2026-20307
- CVE-2026-20284
These other flaws have not yet been flagged as actively exploited, but given the pattern of attacks on ISE, they should be patched as part of the same upgrade cycle.
A History of Cisco ISE Exploitation
This is not the first time Cisco ISE has been targeted. In July 2025, threat actors exploited another Cisco ISE zero-day (CVE-2025-20337) with a maximum severity score in remote code execution attacks to deploy a custom "IdentityAuditAction" web shell disguised as a legitimate ISE component.
Over the last five years, CISA tagged 99 security flaws in Cisco products as actively exploited in attacks, including seven abused in ransomware attacks.
Cisco products are a consistent target. If your organization runs Cisco infrastructure, treat ISE patching as a recurring, high-priority operational task — not a one-off event.
What Businesses Should Do
If your organization runs Cisco ISE or ISE-PIC, this is an urgent situation. Here's a practical checklist:
- Identify all ISE and ISE-PIC deployments — Including any shadow or forgotten instances
- Upgrade immediately to a fixed release — 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, or 3.5 P4
- Do not wait for a workaround — None exists; patching is the only option
- Hunt for compromise — Review
access.logon every node for suspicious usernames - Check firewall and network logs — Look for uploads or downloads to/from external or malicious IPs
- Assume root-level access if compromised — Re-image nodes and restore from known-good backups
- Review ISE configuration — Look for unauthorized policy changes or new admin accounts
- Rotate credentials — Assume any secrets stored in ISE may be exposed
- Apply the other ISE patches — CVE-2026-76423 and the five additional critical flaws
- Report to CISA if applicable — Federal agencies have a three-day deadline; others should follow KEV guidance
- Review your Zero Trust assumptions — If ISE is your policy engine, validate that it hasn't been undermined
If your organization needs help patching Cisco ISE at scale, hunting for indicators of compromise, or validating Zero Trust controls after a potential breach, consider engaging a managed security partner.
Final Thoughts
CVE-2026-76460 is a maximum-severity authentication bypass in a platform that many organizations rely on to enforce Zero Trust. It's being actively exploited, it has no workaround, and CISA has given federal agencies just three days to patch.
If you run Cisco ISE or ISE-PIC, treat this as a break-glass priority.
Key takeaways:
- CVE-2026-76460 — Maximum-severity authentication bypass in Cisco ISE and ISE-PIC
- Actively exploited — Confirmed by Cisco PSIRT
- No workarounds — Patching is the only remediation
- Configuration-independent — Affects all ISE configurations
- Fixed releases available — 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4
- CISA KEV — Added to the catalog with a three-day federal deadline
- Hunting guidance — Check
access.logon every node; review firewall/network logs - Assume root compromise — Re-image nodes and restore from backups if malicious activity is suspected
- Other ISE flaws — CVE-2026-76423 and five additional critical issues patched this week
- Cisco is a recurring target — 99 Cisco flaws in CISA KEV over the last five years, seven tied to ransomware
If your organization needs emergency help patching Cisco ISE, hunting for compromise, or validating network access controls after a potential breach, contact SystemLogicIT for expert guidance across the United States and United Kingdom.