As reported by BleepingComputer, Cisco has disclosed a maximum-severity zero-day in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that is under active exploitation in the wild. CISA has already added the flaw to its Known Exploited Vulnerabilities Catalog with a three-day binding remediation directive for federal agencies—a timeline that underscores the urgency.
Why This Vulnerability Is Especially Dangerous
Cisco ISE is the policy backbone for network access control in many enterprises, often sitting at the heart of Zero Trust architectures. An authentication bypass on a platform whose entire purpose is to authenticate users and devices is about as consequential as it gets. Successful exploitation grants attackers access to the web-based management interface, and based on Cisco's advisory language around root-level command execution and evidence tampering, this is not merely a read-only intrusion—it opens the door to full administrative compromise.
The fact that no workarounds exist and the flaw is configuration-independent means every exposed ISE deployment is vulnerable until patched. There is no interim mitigation.
Vulnerability Summary
| Field | Detail |
|---|---|
| CVE | CVE-2026-76460 |
| Severity | Maximum / Critical |
| Type | Authentication bypass via insufficient API authentication controls |
| Affected Products | Cisco ISE, Cisco ISE-PIC |
| Affected Releases | 3.1, 3.2, 3.3, 3.4, 3.5 |
| Fixed Releases | 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 |
| Active Exploitation | Yes — confirmed by Cisco PSIRT |
| Workaround | None available |
| Additional CVEs Patched (not yet exploited) | CVE-2026-76423, CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284 |
Who Is Most at Risk
Broader Implications
This is the second ISE zero-day exploited in the wild in roughly a year—CVE-2025-20337 was actively exploited in July 2025. A pattern is emerging: ISE's API surface and authentication mechanisms are becoming a preferred target for threat actors who recognize that compromising the NAC layer effectively subverts the entire network access model. Defenders should treat ISE as a Tier-0 asset equivalent to domain controllers and identity providers, with commensurate hardening, monitoring, and patching SLAs.
Shield53 Recommendations
Immediate Actions
- Patch now. Apply the fixed release for your version immediately. For federal agencies, the CISA deadline is three days; private-sector organizations should treat this with equal urgency.
- Restrict management access. Ensure ISE admin interfaces are accessible only from dedicated management VLANs or via VPN. No ISE admin port should be internet-facing.
- Hunt for compromise. Review
access.logfiles on every ISE node for suspicious usernames. Cross-reference firewall and network logs for anomalous inbound/outbound connections, file transfers, and unexpected administrative sessions. - If compromise is suspected: re-image and restore. Cisco explicitly recommends re-imaging affected nodes from known-good backups rather than attempting to clean a compromised system. Assume root-level access means persistence and evidence wiping have occurred.
- Patch the other six CVEs. While not yet flagged as exploited, CVE-2026-76423 is another maximum-severity authentication bypass. Do not stage these—include them in the same maintenance window.
Longer-Term Hardening
- Implement network segmentation that isolates ISE infrastructure from general corporate traffic.
- Deploy enhanced logging and forward ISE logs to a SIEM with alerting on anomalous API calls, authentication anomalies, and privilege changes.
- Establish a 24-hour patch SLA for ISE critical vulnerabilities going forward, given the demonstrated exploitation pattern.
- Conduct regular posture reviews of ISE API exposure and disable unused integrations that expand the attack surface.
