Cisco has identified a critical security vulnerability in its Identity Services Engine (ISE), currently being exploited by attackers. Labeled as CVE-2026-76460, this zero-day flaw has a maximum severity score of 10.0 according to the Common Vulnerability Scoring System (CVSS). The vulnerability allows unauthenticated remote attackers to bypass the authentication process.
Understanding the Severity of the Flaw
The flaw arises from inadequate authentication controls on an API endpoint in the ISE, as confirmed by Cisco. Attackers can exploit this weakness by sending specially crafted requests, gaining unauthorized access to the device’s web management interface. This issue affects both Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) across all configurations.
Cisco has released patches to address the vulnerability in different software versions: version 3.1 with Patch 12, version 3.2 with Patch 11, version 3.3 with Patch 12, version 3.4 with Patch 7, and version 3.5 with Patch 4. Customers are strongly urged to upgrade to these patched versions to mitigate potential threats.
Recommendations and Mitigation Strategies
Amid reports of active exploitation, Cisco advises users to review the access logs for suspicious activity. The company recommends using specific command lines to detect unauthorized access attempts. For example, administrators can search for unexpected usernames using the command:
admin#show logging application ise-kong/access.log | include dummyuser
Detections of suspicious entries may indicate a compromise, necessitating immediate re-imaging of affected nodes and restoration from configuration backups. It is important to note that there are no workarounds currently, although infrastructure access control lists (iACLs) can limit access to essential management traffic.
Industry and Government Response
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch (FCEB) agencies have been instructed to apply the relevant patches by September 19, 2026, highlighting the urgency of this threat.
In addition to CVE-2026-76460, Cisco disclosed fixes for several other security issues within its product lineup. These include vulnerabilities in Cisco Secure Email Gateway and Cisco Secure Firewall products, which range from command injection risks to issues allowing unauthorized commands as root users.
Looking Ahead
As cyber threats evolve, the importance of timely patches and proactive security measures cannot be overstated. Organizations utilizing Cisco products should prioritize these updates to safeguard against potential breaches. With security landscapes continually changing, vigilance and swift action remain critical in defending against such high-severity vulnerabilities.
