Attackers Exploit a Maximum-Severity Cisco ISE Flaw From a Nine-Vulnerability Disclosure

Cisco released patches on September 16 for nine vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), and the U.S. Cybersecurity and Infrastructure Security Agency confirms attackers are already exploiting the most severe one. The flaw, tracked as CVE-2026-76460, carries the maximum CVSS score of 10.0 and lets an unauthenticated remote attacker bypass the platform’s own authentication checks entirely.

Cisco ISE is the software many enterprises use to decide which users and devices get onto their network in the first place, often as the enforcement point for a Zero Trust security model. A flaw that lets an outsider walk past that front door carries outsized risk: it is not one application being compromised, it is the system other applications rely on to know who to trust.

CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16 and gave federal agencies until September 19, a three-day window, to patch under Binding Operational Directive 26-04. CISA also flagged this specific entry for mandatory forensic triage, a distinction that carries more weight than the short deadline alone suggests.

What CVE-2026-76460 Actually Does

The bug lives in an API endpoint that ISE and ISE-PIC expose regardless of how an administrator has configured the rest of the platform. Cisco’s advisory describes the root cause plainly: “This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint.” A successful exploit lets the attacker “gain unauthorized access to the affected device by bypassing the web-based management interface,” and from there, execute commands with root privileges.

Cisco’s Product Security Incident Response Team confirmed the flaw is already being used in real attacks: “The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” Cisco’s advisory says it found the bug while resolving a Cisco Technical Assistance Center support case, not through an outside researcher’s report.

There is no full workaround, though Cisco does describe one partial mitigation: restricting the management interface with infrastructure access control lists (iACLs) so only expected management traffic can reach the device at all. Short of that, patching is what Cisco is actually recommending, and the fix applies across every currently supported ISE branch:

Cisco’s advisory notes that release 3.0 has already reached End of Software Maintenance and gets no fixed version at all; those deployments need to migrate to a supported, patched branch entirely rather than wait for a point patch.

Forensic Triage: More Than Just Patching by Friday

Most KEV entries carry a single instruction: patch within the deadline. This one carries a second flag, forensicTriage: Yes, tied to CISA’s BOD 26-04 implementation guidance, and it changes the order of operations for any federal agency running affected ISE deployments.

The guidance asks agencies to prioritize preserving volatile evidence, memory contents, running processes, registry state, before they remediate, on the reasoning that patching or rebooting a compromised system can destroy the very evidence needed to determine whether it was actually breached. CISA’s recommended timeline, which it describes as best practice rather than a hard requirement, calls for scoping affected systems within two hours of the KEV addition, collecting evidence and patching within roughly a day, containing anything suspicious without tipping off the attacker, and producing a forensic triage report within 48 to 72 hours. Confirmed compromises get escalated to CISA’s own incident reporting system. In practice, that means “patch it” is not quite the whole instruction here; agencies are also expected to check, carefully and in the right order, whether the flaw was already used against them before they close it.

A Second Maximum-Severity Bug, Not Yet Reported Under Attack

CVE-2026-76460 was not disclosed alone. The same batch includes CVE-2026-76423, an equally maximum-severity, CVSS 10.0 flaw that Cisco has not flagged as actively exploited, at least not yet. It works through a different door than the first bug: rather than a weak check on the management-interface API, this one stems from ISE’s REST API web service being exposed with insufficient authorization checks in the first place. Cisco’s own description is direct about the blast radius: a successful exploit “could allow the attacker to read and modify ISE configuration and identity data with administrative privileges,” again without needing any credentials at all.

That two unauthenticated, root-or-admin-granting bugs shipped in the same disclosure, with only one confirmed under attack so far, is itself worth attention. Absence from the KEV catalog is not the same as absence of risk; it often just means nobody has caught anyone using it yet.

Seven More Bugs Round Out a Nine-CVE Batch

The remaining seven vulnerabilities in the same disclosure all require an attacker to already hold valid credentials, which lowers their real-world urgency relative to the two unauthenticated bugs above, but several still carry near-maximum severity scores:

• CVE-2026-20307 (CVSS 9.9): an authenticated attacker can execute arbitrary commands on the underlying operating system through ISE’s web-based management interface.
• CVE-2026-20176 and CVE-2026-20211 (CVSS 9.1 each): separate authenticated command-execution paths on the underlying OS.
• CVE-2026-20305 and CVE-2026-20306 (CVSS 9.1 each): authenticated command injection through ISE’s diagnostic tools and REST API respectively, each escalating to root.
• CVE-2026-20284 (CVSS 9.1): an authenticated SQL injection flaw in ISE’s SXP REST API, caused by insufficient validation of user-supplied input.
• CVE-2026-76424 (CVSS 7.2): an authenticated attacker can upload or copy arbitrary files onto the device through the REST API.

All seven were disclosed and patched in the same September 16 batch as the two unauthenticated bugs above. The practical takeaway for anyone running ISE is that this was not really “one zero-day plus routine housekeeping.” It was nine distinct paths into a system that is supposed to be the thing deciding who else gets in.

How Cisco Says to Check for Prior Compromise

Because CVE-2026-76460 grants root-level command execution, Cisco warns that an attacker who already used it can remove evidence of having done so. The company’s guidance for administrators includes checking the access.log file on every node for suspicious usernames, using a command Cisco published directly in its advisory: admin#show logging application ise-kong/access.log | include dummyuser, where dummyuser is a placeholder for whatever unfamiliar or unexpected account name shows up in an environment’s own logs.

Cisco also recommends cross-checking firewall and network logs for unexplained uploads or downloads to or from external or otherwise suspicious IP addresses, and, if any of that turns up something suspicious, re-imaging the affected nodes and restoring them from a known-good backup rather than trusting an in-place cleanup. Given that a compromised node can be leveraged to erase its own tracks, treating an ISE deployment as untrustworthy the moment suspicious activity appears, rather than trying to patch around it, is the safer default.

Not ISE’s First Brush With a Zero-Day

This is not the first time attackers have found their way into Cisco ISE ahead of a patch. In July 2025, threat actors exploited a separate maximum-severity Cisco ISE zero-day, CVE-2025-20337, to gain remote code execution and deploy a custom web shell disguised as a legitimate ISE component, one they named “IdentityAuditAction.”

The pattern extends beyond ISE specifically. Independently checking CISA’s own Known Exploited Vulnerabilities catalog confirms that Cisco products account for 99 entries added over the past five years, seven of which CISA has tied to known ransomware campaigns. It is also the second time this month a Cisco appliance has drawn an emergency, three-day CISA patch deadline for a maximum-severity, actively exploited authentication bypass: sxz.io reported on September 15 that a single crafted email could hand an attacker root access to Cisco’s Secure Email Gateway appliances, with that deadline landing on September 17, one day after CISA added the ISE flaw covered here to the same catalog.

For organizations running Cisco ISE or ISE-PIC in any capacity, whether they are a federal agency bound by CISA’s directive or not, the practical guidance is the same: patching is the real fix, the patches are already available, and the longer an unauthenticated admin-bypass flaw sits unpatched on the system deciding who gets network access, the more it is worth assuming someone has already tried the door.