Cisco on Wednesday released urgent patches for a critical-severity authentication bypass vulnerability in Identity Services Engine (ISE) that has been exploited in the wild as a zero-day.
Tracked as CVE-2026-76460 (CVSS score of 10/10), the security defect impacts an API endpoint of the appliance, which does not apply sufficient authentication controls.
This allows an attacker to send crafted requests to the API and bypass the web-based management interface to gain access to the affected device.
Both Cisco ISE and ISE Passive Identity Connector (ISE-PIC) are affected, regardless of device configuration. While no workarounds exist, using infrastructure access control lists (iACLs) to restrict traffic to the affected device prevents remote exploitation.
To resolve the bug, customers should upgrade to ISE or ISE-PIC versions 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12.
“The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” the company notes in its advisory.
Cisco has not shared any information on who is behind the attacks. Cybercriminals and state-sponsored threat actors regularly target vulnerabilities in the company’s products.
To hunt for potential compromises, organizations should review ‘access.log’ for suspicious usernames. For distributed deployments, the logs for each node should be checked.
“The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed,” the company says.
Additionally, Cisco warns that successful exploitation of CVE-2026-76460 can enable attackers to execute commands with root privileges, which would allow them to hide or delete indicators of compromise (IoCs).
Cross-checking network logs and firewall logs outside of the impacted device should help administrators discover potential compromises, including unexpected uploads/downloads.
On Wednesday, the US cybersecurity agency CISA added the zero-day to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, in line with BOD 26-04 requirements.
Related: Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation
Related: Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Related: Chrome, Firefox Updates Patch 115 Vulnerabilities
Related: Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
