Cisco has swiftly addressed a critical zero-day vulnerability affecting its Identity Services Engine (ISE), issuing an urgent patch on Wednesday. This severe authentication bypass flaw, identified as CVE-2026-76460, has been actively exploited, putting numerous systems at risk.
Understanding the Vulnerability
The vulnerability, which holds the maximum CVSS score of 10, impacts an API endpoint within the ISE appliance. The flaw arises from inadequate authentication controls, allowing attackers to send forged requests to the API. This bypasses the web-based management interface, granting unauthorized access to compromised devices.
Devices and Solutions
Both Cisco ISE and its Passive Identity Connector (ISE-PIC) are affected, irrespective of their specific configurations. While there are no direct workarounds, Cisco advises deploying infrastructure access control lists (iACLs) to limit traffic to the vulnerable devices, thereby preventing remote attacks.
To mitigate this threat, customers are urged to update to specified patched versions: ISE or ISE-PIC versions 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12. Cisco’s Product Security Incident Response Team (PSIRT) emphasizes the urgency of these upgrades due to the ongoing exploitation of the flaw.
Implications and Recommendations
While Cisco has not disclosed details on the attackers, the company notes that both cybercriminals and state-sponsored groups frequently target its products. Organizations are encouraged to scrutinize ‘access.log’ files for unusual usernames as part of their security review. In distributed environments, this log analysis should extend to all nodes.
Cisco also highlights the potential for attackers to execute commands with root privileges if the vulnerability is exploited. This capability could allow them to obscure or remove indicators of compromise (IoCs), complicating detection efforts.
Network administrators should corroborate findings with network and firewall logs to identify any unusual data transfers, which could signal a breach.
Government Response
In response to the vulnerability, the US Cybersecurity and Infrastructure Security Agency (CISA) has added this zero-day to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are mandated to apply the patches within three days, aligning with BOD 26-04’s stringent security protocols.
This incident underscores the persistent threat landscape faced by IT infrastructures and the importance of timely patch management to safeguard against exploits.
Related vulnerabilities in other platforms, such as a root RCE zero-day in Cisco Secure Email Gateway and unauthenticated RCE flaws affecting WordPress sites, further highlight the critical need for vigilant cybersecurity measures across diverse systems.
