Cisco ISE Auth Bypass CVE-2026-76460: What to Patch

Cisco is patching a maximum-severity authentication bypass in its Identity Services Engine that's already being exploited in the wild. CVE-2026-76460 carries a CVSS score of 10.0, lets an unauthenticated attacker walk past ISE's web-based management interface with a single crafted request, and has no workaround — patching is the only fix. If you run ISE anywhere on your network, this is a today problem, not a this-sprint one.

Key Takeaways

• CVE-2026-76460 is a CVSS 10.0 authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC).
• It affects both products regardless of how they're configured, and Cisco's PSIRT confirmed active exploitation on September 16, 2026.
• There's no workaround. Upgrading to a fixed patch release is the only mitigation Cisco recommends.
• CISA added it to the Known Exploited Vulnerabilities catalog on September 16 and gave federal agencies until September 19 to patch.
• This is the second Cisco ISE zero-day exploited in the wild in about a year — a 2025 flaw was used to plant a custom web shell.

What is CVE-2026-76460?

Cisco ISE is the policy engine a lot of enterprises use to decide which users and devices get onto the network and what they can touch once they're in — the kind of thing typically deployed to enforce Zero Trust. CVE-2026-76460 comes down to an API endpoint that doesn't properly check who's calling it. Cisco says an attacker can send a crafted request to that endpoint and bypass the web-based management interface entirely, without any credentials. The flaw hits Cisco ISE and ISE-PIC regardless of how the appliance is configured, so there's no safe configuration that sidesteps it.

Why is this one especially dangerous?

A few things stack up here. First, it's unauthenticated — no phishing, no stolen credentials, no social engineering needed. Second, Cisco's own guidance warns that attackers who exploit it can end up with command execution at root privileges, which is why the company is telling admins to check for signs that logs were tampered with after the fact. Third, ISE sits at a point in the network where compromising it doesn't just give an attacker one box — it can expose policy data, credentials, and a foothold for moving laterally across whatever ISE is meant to be gatekeeping. And fourth: there's no workaround. Cisco isn't offering a config change or a firewall rule as a stopgap. The patch is the mitigation.

Which ISE versions are affected, and what's the fix?

Cisco's advisory lists the following fixed releases:

• ISE/ISE-PIC 3.1 → 3.1 Patch 12
• ISE/ISE-PIC 3.2 → 3.2 Patch 11
• ISE/ISE-PIC 3.3 → 3.3 Patch 12
• ISE/ISE-PIC 3.4 → 3.4 Patch 7
• ISE/ISE-PIC 3.5 → 3.5 Patch 4

ISE 3.0 has already reached end of software maintenance, so there's no patch coming for it — those deployments need to move to a supported release to get the fix at all. Cisco patched CVE-2026-76460 alongside a second maximum-severity auth bypass, CVE-2026-76423, and five other critical issues in the same ISE advisory, though only CVE-2026-76460 has been confirmed as actively exploited so far.

What should you do right now?

Patch first, then check for compromise. Cisco published indicators of compromise alongside the advisory and is telling admins to look through access.log on every ISE node for suspicious usernames. If you find anything that looks like it might be exploitation, Cisco's recommendation is blunt: re-image the node and restore from backup rather than trying to clean it in place, since an attacker with root access can remove evidence of what they did. It's also worth cross-referencing firewall and network logs for unusual traffic to or from the ISE appliance, since exfiltration or follow-on downloads could show up there even if the ISE logs themselves have been scrubbed.

Is this part of a pattern?

Yes. This is the second Cisco ISE zero-day to see active exploitation in roughly a year. In July 2025, attackers used a different maximum-severity ISE flaw to deploy a custom web shell disguised as a legitimate ISE component, giving them a persistent foothold for remote code execution. Over the last five years, CISA has tagged 99 Cisco product flaws as actively exploited, including several used in ransomware campaigns. Identity and network access control platforms are a high-value target precisely because they sit in front of everything else — that's not likely to change, so treating ISE patches as routine maintenance rather than urgent security work is a mistake worth correcting now.

Wrapping Up

If you have Cisco ISE or ISE-PIC anywhere in your environment, check your version against the patch table above today — there's no workaround to buy you time. Once patched, spend twenty minutes cross-checking access.log and your firewall logs against the indicators Cisco published, since active exploitation means some deployments were already hit before the advisory dropped.

Sources

• Cisco Security Advisory: Cisco ISE Authentication Bypass Vulnerability
• BleepingComputer: Cisco warns of max severity ISE zero-day exploited in attacks
• The Hacker News: Cisco Warns of New Zero-Day ISE Auth Bypass Exploited in Active Attacks
• CISA: Known Exploited Vulnerabilities Catalog additions, September 16, 2026