Cisco ISE Zero-Day (CVE-2026-76460, CVSS 10.0) Actively Exploited — No Workaround
A maximum-severity authentication bypass in Cisco Identity Services Engine is being exploited in the wild, with no interim mitigation beyond restricting network access — patching is the only real fix.
Key Takeaways
- CVE-2026-76460 (CVSS 10.0) lets an unauthenticated attacker bypass authentication on an API endpoint behind Cisco ISE's Kong gateway, and Cisco says it is already being exploited.
- There is no workaround — only patched versions (3.1 Patch 12 through 3.5 Patch 4) close the hole; iACLs can reduce exposure but don't eliminate it.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-16 with a federal patch deadline of 2026-09-19.
- Because ISE sits at the center of network access control, a compromise here can cascade into broader network and identity infrastructure — not just the appliance itself.
Cisco has confirmed active exploitation of CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The bug lets an unauthenticated remote attacker send a crafted request to an affected API endpoint and gain unauthorized access to the device, bypassing the web-based management interface entirely.
What's actually broken
The root cause is insufficient authentication control on a specific API endpoint. From ISE 3.1 onward, the Monitoring APIs, External RESTful Services (ERS) APIs, and Open APIs all route through a Kong API Gateway sitting in front of every ISE application server. A gap in authentication checking at that layer doesn't just expose one function — it exposes the whole deployment, and Cisco warns that successful exploitation can ultimately lead to root-level command execution on the device.
That severity is exactly what you'd expect from a network access control (NAC) platform: ISE is the system that decides which devices and users get onto the network in the first place, so an attacker who fully compromises it isn't just popping a box — they're potentially controlling admission decisions for the entire enterprise network.
No workaround — patch is the only real fix
Cisco states there is no workaround for this vulnerability. The only mitigation short of patching is restricting management-plane traffic with infrastructure access control lists (iACLs), which reduces the attack surface but does not close the underlying flaw.
- ISE/ISE-PIC 3.1 — fixed in Patch 12
- ISE/ISE-PIC 3.2 — fixed in Patch 11
- ISE/ISE-PIC 3.3 — fixed in Patch 12
- ISE/ISE-PIC 3.4 — fixed in Patch 7
- ISE/ISE-PIC 3.5 — fixed in Patch 4
CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16, giving Federal Civilian Executive Branch agencies until 2026-09-19 to remediate — a compressed timeline that reflects both the CVSS 10.0 rating and confirmed in-the-wild exploitation.
What to check right now
Beyond patching, Cisco's guidance points defenders to access.log on the ISE application for signs of exploitation attempts, including unexpected or anomalous usernames appearing in requests that should never have reached an authenticated endpoint unauthenticated. Treat any ISE instance exposed to broader network segments — not just the internet — as at risk until patched, since the flaw doesn't require external exposure, only network reachability to the vulnerable API.
Why this matters beyond Cisco shops
This is the pattern security teams should expect more of: a CVSS 10.0 bug in identity/access infrastructure, weaponized before most organizations have patched, with zero workaround. NAC and identity platforms are high-value targets precisely because a single flaw can undermine every downstream access decision they make. Asset inventory and patch velocity for this specific class of infrastructure — not just perimeter-facing systems — deserves the same urgency teams usually reserve for internet-facing zero-days.
Frequently Asked Questions
Is there a workaround for CVE-2026-76460 if I can't patch immediately?
No true workaround exists. Cisco recommends using infrastructure access control lists (iACLs) to restrict who can reach the affected management/API surface, which reduces exposure but does not fix the underlying authentication flaw — patching remains the only complete remediation.
Which Cisco ISE versions are affected by CVE-2026-76460?
ISE and ISE-PIC versions 3.1 through 3.5 are affected. Fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
How do I check if my Cisco ISE deployment has already been targeted?
Review the ISE application's `access.log` for anomalous or unexpected usernames in requests to the affected API endpoint, which can indicate probing or successful exploitation attempts.