Cisco patches actively exploited maximum-severity ISE zero-day

Summary

Cisco says attackers exploited a maximum-severity Cisco ISE zero-day before a patch was available. The flaw enables remote authentication bypass and device takeover; Cisco released indicators of compromise and says no workaround is available.

Key points

CVE-2026-76460 affects an API in Cisco Identity Services Engine (ISE) and was exploited before Cisco disclosed and patched it.
The flaw allows remote authentication bypass and full control of an affected device.
With root access, an attacker could change network access policies, extract stored credentials, delete logs, and move laterally across networks managed by ISE, according to VulnCheck’s Landon Rice.
Cisco said it discovered the vulnerability during a technical support case but did not disclose how many organizations were compromised.
Cisco urged customers to upgrade to fixed software and published indicators of compromise; it said there is no workaround.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. No known threat actor has been linked to the attacks.
Cisco and Rice said CVE-2026-76460 and the separately disclosed CVE-2026-76461 affect different products and are not known to be related.