Cisco discloses critical 10.0-rated ISE vulnerability under active exploitation
Authentication bypass flaw grants attackers root access with no credentials required
1Critical ISE vulnerability exposed
Cisco disclosed CVE-2026-76460, a maximum 10.0 CVSS-rated authentication bypass flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector. The vulnerability allows unauthenticated remote attackers to execute commands with root privileges through crafted API requests. Cisco's Product Security Incident Response Team confirmed active exploitation, prompting urgent patching recommendations. The flaw affects all vulnerable ISE and ISE-PIC versions regardless of configuration.
2Attackers can cover tracks
Successful exploitation grants root access, enabling attackers to remove or conceal intrusion traces. Cisco warns this complicates breach detection efforts. The vulnerability stems from insufficient authentication controls on an API endpoint within Cisco's network access control platform. No credentials or user interaction are required for exploitation. This follows another critical 9.8-rated flaw (CVE-2026-76461) in Cisco's email security products disclosed earlier in September.
3Detection and mitigation steps
Cisco advises admins to review ISE access logs for suspicious usernames across all nodes in distributed deployments. They should also examine external network and firewall logs for unexpected upload/download activity. If evidence of exploitation exists, Cisco strongly recommends reimaging affected nodes and restoring configurations from backups. While no workaround exists, infrastructure access control lists can temporarily restrict management traffic to vulnerable systems.
4Patch availability
Permanent fixes are included in ISE and ISE-PIC versions 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Cisco notes ISE 3.0 has reached end of maintenance, requiring migration to supported releases. The company discovered the vulnerability while resolving a Technical Assistance Center case but hasn't disclosed exploitation details or attacker identities. CISA added the flaw to its Known Exploited Vulnerabilities catalog.
5Broader patching urgency
The ISE vulnerability was part of a substantial batch of Cisco security advisories published Wednesday. Two other flaws received maximum 10.0 CVSS scores, while three remote code execution vulnerabilities scored as high as 9.9. This comes days after the email gateway vulnerability disclosure, making September particularly demanding for Cisco administrators responsible for applying multiple critical patches across different product lines.
6Technical impact analysis
The vulnerability's perfect 10.0 score reflects its combination of attack vector (network), low complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Attackers can fully compromise affected systems through the API endpoint flaw. The web-based management interface bypass means traditional authentication measures provide no protection against this exploit.
7Enterprise security implications
As ISE is Cisco's primary network access control solution, this vulnerability poses significant risk to enterprise networks. Successful exploitation could allow attackers persistent access to critical network infrastructure. The ability to conceal intrusion attempts makes this particularly dangerous for organizations without comprehensive logging and monitoring capabilities across all network segments.
8Prioritization guidance
Security teams should prioritize patching ISE systems given the active exploitation and critical nature of this vulnerability. Organizations should also review their incident response plans for network access control system compromises. The consecutive high-severity vulnerabilities in Cisco products highlight the need for enhanced vulnerability management processes during periods of frequent critical patch releases.