Cisco ISE Zero-Day Under Attack

Cisco has released security updates for a maximum-severity flaw in its Identity Services Engine, and the company says the bug is already being used in real attacks. There is no workaround, so applying the fixed software is the only route Cisco recommends for closing the hole.

The flaw, tracked as CVE-2026-76460, allows remote attackers to bypass authentication by exploiting a weakness in an API of Cisco Identity Services Engine and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of configuration.

What the Flaw Actually Does

Cisco attributes the issue to insufficient authentication control on an API endpoint. An attacker can trigger it by sending a crafted request to an affected endpoint.

"This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint," the company explained. "A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface."

Active Exploitation Confirmed

Cisco also warned customers on Wednesday to secure their systems since its Product Security Incident Response Team (PSIRT) flagged CVE-2026-76460 as actively exploited.

"The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."

Fixed Releases to Match

Because no workarounds exist, applying the security updates is the only recommended course of action to protect networks from ongoing attacks. Cisco published the following mapping of ISE and ISE-PIC release trains to their first fixed versions:

• 3.1 — 3.1 Patch 12
• 3.2 — 3.2 Patch 11
• 3.3 — 3.3 Patch 12
• 3.4 — 3.4 Patch 7
• 3.5 — 3.5 Patch 4

Hunting for Signs of Compromise

Cisco shared indicators of compromise and advised security teams to look for suspicious usernames in access.log files on every node and "strongly" recommended re-imaging the nodes and restoring them from backups if malicious activity is suspected.

Admins should also cross-check firewall and network logs for signs of suspicious activity (including downloads and uploads from and to external or malicious IP addresses) because attackers may remove evidence of exploitation after obtaining command execution with root privileges.

The Other Flaws in the Same Batch

Yesterday, Cisco patched a second maximum-severity authentication bypass flaw (CVE-2026-76423) and five other critical security issues (tracked as CVE-2026-76460, CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, and CVE-2026-20284) in Cisco ISE and Cisco ISE-PIC, but they have not yet been flagged as actively exploited.

CISA's Three-Day Deadline

The Cybersecurity and Infrastructure Security Agency (CISA) also ordered federal agencies to patch their systems against CVE-2026-76460 within three days after adding it to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday.

ISE's History as a Target

In July 2025, threat actors exploited another Cisco ISE zero-day (CVE-2025-20337) with a maximum severity score in remote code execution attacks to deploy a custom "IdentityAuditAction" web shell disguised as a legitimate ISE component.

Over the last five years, CISA tagged 99 security flaws in Cisco products as actively exploited in attacks, including seven abused in ransomware attacks.

What It Means for Defenders

CVE-2026-76460's exploitation status is the clearest signal for where to start. Because the flaw affects both ISE and ISE-PIC regardless of configuration, there is no setting an administrator could have flipped to close the hole — only the fixed releases above. Identify which release train is deployed, upgrade to the corresponding fixed release, and treat the patch as urgent given the active exploitation flag.

The hunt guidance deserves equal attention. Reviewing access.log files on every node for suspicious usernames gives a direct view into whether unauthorized access occurred. Checking firewall and network logs for unexpected uploads and downloads to external addresses helps surface data movement or tooling transfers that would otherwise go unseen. Where suspicious activity is found, Cisco's recommendation to re-image affected nodes and restore from backups reflects the possibility that an attacker obtained root-level command execution and may have altered the system in ways that are difficult to fully audit.

For organizations that have built Zero Trust architectures with ISE as a central component, an authentication bypass on that system can carry consequences beyond the appliance itself, since ISE is a centralized policy platform that IT administrators use to manage endpoints, users, and device access to network resources, often while enforcing Zero Trust security models. Cisco did not describe a scenario in which attackers limited themselves to the initial bypass, and its guidance to review logs for evidence removal after root-level command execution suggests defenders should assume a foothold may not stay confined to the management interface. The three-day federal deadline is a signal of how quickly CISA expects action; private-sector teams running the affected branches would be following the same fix path, with patching plus hunting as the immediate steps the source material supports.