Cisco Fixes Critical ISE Vulnerability Under Active Exploitation
The CVE-2026-76460 vulnerability, rated CVSS 10.0, allows authentication bypass in Cisco ISE and ISE-PIC. Cisco confirmed its active exploitation and released fixes.
Cisco ISE and ISE-PIC contain the critical CVE-2026-76460 vulnerability, whose active exploitation Cisco has confirmed. A remote unauthenticated attacker can bypass API authentication with a crafted request and gain unauthorized access through the web-based management interface.
The company disclosed the flaw on September 16, 2026, at 16:00 GMT under the identifier CVE-2026-76460. It received the maximum CVSS score of 10.0. Cisco released fixes for the affected supported branches and recommends prioritizing their deployment. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities catalog.
Cisco ISE: Authentication Bypass in the API
According to Cisco’s security advisory, this is an authentication-bypass flaw in the API of ISE and ISE-PIC systems. The attacker does not need credentials: a prepared, modified request can bypass authentication for the web-based management interface.
Cisco states that after successful exploitation, an attacker can execute commands with root privileges. The attacker may also erase traces of their activity on the compromised device. Cisco’s PSIRT confirmed that the flaw is already being actively exploited in attacks.
ISE is a platform for managing user and device access to an enterprise network. It manages access policies and network identity, so compromise of its administrative interface is particularly serious for organizations that expose it to untrusted or overly broad network segments.
Available Fixes for ISE and ISE-PIC
Cisco fixed the flaw in these releases:
- ISE/ISE-PIC 3.1 Patch 12,
- ISE/ISE-PIC 3.2 Patch 11,
- ISE/ISE-PIC 3.3 Patch 12,
- ISE/ISE-PIC 3.4 Patch 7,
- ISE/ISE-PIC 3.5 Patch 4.
No full workaround is available for CVE-2026-76460. Cisco therefore recommends deploying the fix. As a temporary mitigation, it advises restricting management access using infrastructure access control lists (iACLs).
Operators should review which ISE and ISE-PIC instances they use, compare their versions with the fixed releases, and prioritize deployment of the fix. Alongside deploying the fix, management connectivity should be limited to only the necessary administrative networks and systems.
Checking for Possible Compromise
Because Cisco states that attackers may execute commands with root privileges and erase traces, reviewing local ISE records alone may not be sufficient. Organizations should also examine relevant logs and monitoring data outside the affected device, especially records of access to the management interface and unusual administrative activity.
Cisco has not yet disclosed information about the attackers, the number of affected organizations, or the precise course of the attacks. No public confirmation exists that this flaw is linked to ransomware campaigns or to other critical ISE vulnerabilities that Cisco announced on the same day.
Further developments may provide technical indicators of compromise, more detailed information about the attacks, or revisions to Cisco’s security advisory.
Sources
- Cisco Security Advisory: Cisco Identity Services Engine Authentication Bypass Vulnerability – Confirms CVE-2026-76460, CVSS 10.0, active exploitation, affected products, fixed versions, the absence of a workaround, and the recommended mitigation.
- CISA Known Exploited Vulnerabilities Catalog – Lists CVE-2026-76460 in the catalog of vulnerabilities known to be exploited in the wild.
- SecurityWeek: Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day – Independently summarizes the emergency patch release and active exploitation.
Verified and updated: September 17, 2026, 09:06
