Cisco has released urgent security updates for a maximum-severity vulnerability in Identity Services Engine. Attackers are already exploiting the Cisco ISE zero-day, while no workaround can protect vulnerable systems.
Authentication Flaw Exposes Cisco ISE Systems
Cisco tracks the vulnerability as CVE-2026-76460. It affects Cisco Identity Services Engine and the ISE Passive Identity Connector, regardless of their configuration.
ISE provides a central platform for managing users, endpoints and access to network resources. Organisations often use it to enforce Zero Trust security policies.
The vulnerability stems from insufficient authentication controls in an API endpoint. A remote attacker can exploit the flaw by sending a specially crafted request to a vulnerable system.
A successful attack bypasses the web-based management interface and grants unauthorised access to the device. Moreover, attackers may eventually execute commands with root privileges.
Cisco assigned the vulnerability the highest possible severity rating. Its Product Security Incident Response Team also confirmed that attackers are exploiting it in real-world operations.
Cisco Urges Customers to Install Updates
Cisco has not provided any workarounds for CVE-2026-76460. Therefore, administrators must upgrade to a fixed software release to secure affected systems.
The required update depends on the installed version:
| Cisco ISE or ISE-PIC release | First fixed release |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
Cisco strongly recommends installing the appropriate patch as soon as possible. Delaying the update leaves affected networks exposed to ongoing attacks.
Administrators Should Search for Intrusions
Cisco also published indicators of compromise to help organisations identify possible breaches. Security teams should inspect the access.log files on every node for suspicious usernames.
In addition, administrators should review firewall and network logs for unusual external connections. They should pay particular attention to suspicious uploads and downloads involving unknown or malicious IP addresses.
Attackers may delete evidence after gaining root access. Consequently, an absence of obvious indicators does not necessarily confirm that a system remains secure.
If administrators suspect malicious activity, Cisco strongly recommends re-imaging the affected nodes. Teams should then restore them from trusted backups.
CISA Gives Federal Agencies Three Days to Patch
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-76460 to its Known Exploited Vulnerabilities catalogue on Wednesday.
As a result, US federal civilian agencies must patch affected systems within three days. The unusually short deadline reflects the flaw’s severity and confirmed exploitation.
Cisco also addressed another maximum-severity authentication bypass vulnerability, CVE-2026-76423. Additionally, the company patched several other critical issues affecting ISE and ISE-PIC.
However, Cisco has not reported active exploitation of those additional vulnerabilities.
Earlier ISE Zero-Day Enabled Web Shell Attacks
This incident follows the exploitation of another maximum-severity Cisco ISE vulnerability in July 2025.
Attackers used CVE-2025-20337 to conduct remote code execution attacks. They also deployed a custom web shell called IdentityAuditAction, which they disguised as a legitimate ISE component.
Cisco products remain frequent targets for cyberattacks. During the last five years, CISA classified 99 Cisco vulnerabilities as actively exploited. Attackers also used seven of those security flaws in ransomware campaigns.
The latest Cisco ISE zero-day reinforces the need for rapid patching and careful log analysis. Organisations that cannot rule out compromise should rebuild affected nodes from trusted backups.
0 responses to “Cisco ISE Zero-Day Exploited in Active Attacks”