Cisco is urging customers to patch a maximum-severity vulnerability in its Identity Services Engine after confirming that attackers are already exploiting the flaw in the wild.
Tracked as CVE-2026-76460, the vulnerability carries a CVSS score of 10.0, the highest possible severity rating. It affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. Cisco says there are no workarounds that fully address the vulnerability, making an upgrade to a fixed software release the primary remediation.
An Authentication Bypass at the Center of Network Access
The vulnerability exists because an API endpoint in Cisco ISE does not enforce sufficient authentication controls. According to Cisco, an unauthenticated remote attacker can send a specially crafted request to the affected endpoint and bypass the product’s web-based management authentication.
Successful exploitation can give the attacker unauthorized access to the affected device without first supplying valid administrative credentials. Cisco’s security advisory classifies the flaw as critical and confirms that its Product Security Incident Response Team, or PSIRT, is aware of active exploitation.
That combination makes CVE-2026-76460 particularly serious. An attacker does not need an existing account, does not need a victim to click a link, and can target the vulnerable service remotely if it is reachable.
Why Cisco ISE Is Such a Valuable Target
ISE occupies a sensitive position inside many enterprise networks. Organizations use the platform to identify users and devices, evaluate their security posture, enforce network access policies, and determine which resources they are permitted to reach.
Instead of compromising an ordinary employee workstation, an attacker targeting ISE is going after infrastructure that helps decide who and what should be trusted on the network.
That makes an authentication bypass considerably more consequential than unauthorized access to a typical application. Once security infrastructure itself becomes compromised, attackers may be operating from a system that organizations normally consider trusted.
The potential impact goes even further. Cisco warns that access obtained through CVE-2026-76460 can ultimately allow an attacker to execute commands with root privileges, giving the intruder extensive control over the affected system.
Attackers Could Attempt to Hide Their Activity
Root-level access creates an additional problem for incident responders because an attacker may be able to alter or delete evidence stored on the compromised ISE system.
Cisco has therefore advised administrators investigating possible exploitation to review the product’s access.log for suspicious usernames and to perform that review on every node in an ISE deployment.
But administrators should not rely exclusively on logs stored on the potentially compromised device. Cisco recommends cross-checking external network and firewall logs for suspicious activity, including unexpected uploads from the affected system or downloads involving malicious IP addresses.
That distinction is important. Applying the patch prevents future exploitation of the vulnerability, but it does not establish that an organization was not compromised before the update was installed.
If malicious activity is suspected, Cisco recommends re-imaging affected nodes and restoring them from a configuration backup if necessary.
No Workaround Means Patching Is the Priority
Cisco has released fixes across the currently affected ISE branches.
The first fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Cisco ISE 3.0 has already reached the end of software maintenance, and customers still running that release are advised to migrate to a supported version containing the fix.
Cisco explicitly states that there are no workarounds that address CVE-2026-76460. Infrastructure access controls can help restrict which systems can communicate with ISE, but they should be treated as additional protection rather than a replacement for installing the security update.
Another Cisco Zero-Day in the Same Week
The disclosure increases the pressure on administrators because it follows another actively exploited Cisco vulnerability only days earlier.
That earlier issue, CVE-2026-76461, affects AsyncOS Software used by Cisco Secure Email Gateway and carries a CVSS score of 9.8. Its appearance so close to the ISE disclosure means some organizations responsible for large Cisco environments are dealing with consecutive emergency patching cycles.
The vulnerabilities are separate issues affecting different Cisco products, so the rapid succession should not be interpreted as evidence that they share the same underlying flaw or attacker.
It does, however, create an operational challenge. Security teams that have just inventoried and patched one critical Cisco platform now need to identify vulnerable ISE deployments, schedule another upgrade, and determine whether attackers reached those systems before remediation.
CVE-2026-76460 Should Not Be Confused With Other ISE Flaws
Cisco disclosed several ISE security issues as part of its September security updates, making the CVE numbers easy to confuse.
In particular, CVE-2026-20285 and CVE-2026-20286 are separate authorization-bypass vulnerabilities affecting the ISE web management interface. Those flaws carry a CVSS score of 4.3 and require valid administrator credentials for exploitation.
Cisco says it is not aware of malicious exploitation of CVE-2026-20285 or CVE-2026-20286. They are therefore distinct from CVE-2026-76460, the maximum-severity authentication bypass currently being exploited.
Cisco’s September ISE security release also addresses additional vulnerabilities involving REST API authentication bypass, remote code execution, SQL injection, and XML External Entity injection. The number of issues makes it especially important for administrators to evaluate the complete ISE security update rather than focusing on a single CVE.
Security Infrastructure Is Becoming the Target
The incident illustrates a larger problem facing enterprise defenders. Attackers increasingly have incentives to target the infrastructure that enforces security rather than attacking endpoints individually.
Identity platforms, VPN gateways, firewalls, email security appliances, and network management systems can occupy highly trusted positions and often have broad visibility or privileges across an organization.
An authentication bypass in one of those systems can also undermine protections that normally work well against credential attacks. Strong passwords and multifactor authentication provide limited protection when a software vulnerability allows an attacker to circumvent the authentication process entirely.
For organizations using Cisco ISE, CVE-2026-76460 should therefore be treated as more than another item in a vulnerability scanner. It combines the factors security teams generally consider most urgent: remote exploitation, no authentication requirement, maximum severity, privileged impact, no workaround, and confirmed attacks in the wild.
The immediate priority is patching. The second is determining whether exploitation happened before the patch arrived.
With attackers already targeting the vulnerability, the critical question for administrators is no longer simply whether their Cisco ISE deployment is vulnerable. It is whether someone reached it before they did.
