Cisco Patches Actively Exploited Critical ISE Authentication Bypass Zero-Day
Summary
Cisco patched CVE-2026-76460, an actively exploited authentication bypass affecting ISE and ISE-PIC. The flaw can enable root command execution; Cisco recommends upgrading, while iACLs can prevent remote exploitation.
Key points
- CVE-2026-76460 affects an API endpoint in Cisco ISE and ISE-PIC and permits crafted requests to bypass authentication.
- Cisco says the vulnerability is being actively exploited; the attacker identity is unknown.
- Successful exploitation can enable root-level command execution and allow attackers to hide or delete indicators of compromise.
- Fixed releases are ISE and ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12.
- Cisco says no workaround is available, but infrastructure access control lists can restrict traffic and prevent remote exploitation.
- Cisco advises reviewing access.log on every deployment node and checking external network and firewall logs; suspected compromised nodes should be re-imaged and restored from backup if needed.
- CISA added the zero-day to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical (CVSS 10/10)
- Affected Versions
- Cisco ISE
- Cisco ISE-PIC
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Use infrastructure access control lists (iACLs) to restrict traffic to the affected device and prevent remote exploitation.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterSuccessful exploitation can enable attackers to execute commands with root privileges.T1070 · Indicator RemovalAttackers with root privileges could hide or delete indicators of compromise.T1190 · Exploit Public-Facing ApplicationAttackers exploit the unauthenticated API endpoint on Cisco ISE or ISE-PIC to bypass the management interface and access the device.
CVE
Vendors
Products
Cisco ISECisco on Wednesday released urgent patches for a critical-severity authentication bypass vulnerability in Identity Services Engine (ISE) that has been exploited in the wild as a zero-day.Cisco ISE-PICBoth Cisco ISE and ISE Passive Identity Connector (ISE-PIC) are affected, regardless of device configuration.