Cisco warns of max severity ISE zero-day exploited in attacks

Cisco has released emergency patches for a maximum-severity authentication bypass flaw in Identity Services Engine that attackers have already been exploiting as a zero-day.

The vulnerability, tracked as CVE-2026-76460, carries a CVSS score of 10 out of 10. Cisco disclosed active exploitation on September 16, 2026.

What the Flaw Does

The problem sits in an ISE API endpoint that does not apply sufficient authentication controls.

Remote, unauthenticated attackers can send crafted requests to that API and bypass the web-based management interface entirely, gaining access to the device. From there, successful exploitation allows execution of commands with root privileges.

Both Cisco ISE and ISE Passive Identity Connector are affected, regardless of device configuration. There is no configuration that makes a system safe.

Why ISE Is a Particularly Bad Thing to Lose

Identity Services Engine is the platform large organisations use to control network access and enforce security policy. It sits at the centre of authentication, authorisation and accounting.

That position is what makes this severe. Compromising an ISE deployment does not just give an attacker one server. It gives them the system that decides who gets onto the network and what they are allowed to reach — enabling authentication bypass, policy manipulation and credential harvesting across the environment.

Estimates put ISE deployments in the tens of thousands of organisations.

The Detail Defenders Need to Read Twice

Cisco warned that root-level command execution lets attackers hide or delete indicators of compromise.

That changes how investigation has to work. If an attacker has root on the device, the device's own logs cannot be trusted to tell you whether it was compromised.

Cisco's guidance is to cross-check network logs and firewall logs from outside the affected appliance, looking specifically for unexpected uploads and downloads. Evidence that survives is evidence the attacker could not reach.

Patching and Timeline

Cisco has released fixed releases across multiple versions. The update must be applied to every node in a deployment — a partial rollout leaves the exposure open.

There are no workarounds. The only mitigation short of patching is restricting traffic to the appliance using infrastructure access control lists, which limits reachability but does not fix the flaw.

CISA added the zero-day to its Known Exploited Vulnerabilities catalog the same day, giving federal agencies three days to patch under BOD 26-04 requirements. A three-day KEV deadline is at the aggressive end of what CISA issues and reflects both the severity and the active exploitation.

This Is a Pattern, Not an Incident

ISE has been a repeated target, and the history is worth knowing because it shapes how urgently to treat this.

In June and July 2025, Cisco disclosed three maximum-severity ISE remote code execution flaws — CVE-2025-20281, CVE-2025-20282 and CVE-2025-20337 — and within weeks confirmed that two of them were being exploited in the wild.

CVE-2025-20337 became the more consequential of the three. Amazon's threat intelligence team reported in November 2025 that attackers had used it to deploy custom backdoor malware, discovering the activity while investigating Citrix Bleed 2. CJ Moses, CISO of Amazon Integrated Security, noted that exploitation was occurring before Cisco had even assigned a CVE number or released patches across all affected ISE branches.

Amazon's assessment described an actor with advanced knowledge of Java, Tomcat internals and ISE architecture, using multiple undisclosed zero-days — but with targeting that appeared indiscriminate rather than narrowly scoped, which does not match the usual profile of a highly resourced operation.

The company has had a difficult run more broadly. This week Cisco also patched a Secure Email Gateway zero-day, CVE-2026-76461, allowing unauthenticated root command execution through crafted email messages, alongside four other critical SEG and SEWM flaws. In January it patched CVE-2025-20393, a maximum-severity AsyncOS flaw exploited since November 2025 by a Chinese threat group tracked as UAT-9686.

Since November 2021, CISA has flagged 98 Cisco vulnerabilities as actively exploited, seven of them abused by ransomware groups.

What to Do Now

The sequence matters more than speed alone.

Confirm exposure first — identify every ISE and ISE-PIC node and its current version. Apply the fixed release to all of them. Then hunt for compromise, with particular attention to changes in administrator identities and to authentication and policy configuration, using log sources outside the appliance.

Doing those in order matters because patching alone does not evict an attacker who already has root. If the device was compromised before the fix, the fix closes the door behind them rather than removing them.

Restricting management interface access to trusted hosts is worth doing regardless, and should have been in place already.