Cisco Patches Maximum-Severity ISE Zero-Day Under Active Attack

A maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) is currently under active exploitation, requiring immediate remediation across affected enterprise environments. Identified as CVE-2026-76460 with a maximum CVSS score of 10.0, the security flaw allows an unauthenticated remote attacker to bypass authentication controls and execute commands with root privileges.

The flaw represents the second major zero-day disclosure for Cisco within a short span, following closely on the heels of CVE-2026-76461—a 9.8-rated critical execution flaw affecting Cisco Secure Email Gateway and Secure Email and Web Manager appliances that was also disclosed under active attack.

Mechanics of the API Authentication Bypass

The vulnerability resides within an API endpoint serving the Cisco ISE web-based management interface. It stems from insufficient authentication and authorization checks when processing incoming requests to specific API routes.

In a properly secured API architecture, the web application framework intercepts incoming requests, validates session tokens or authentication headers, and enforces role-based access controls before handing execution off to underlying system scripts or binaries. Under CVE-2026-76460, an unauthenticated attacker can craft specialized HTTP requests directly targeting vulnerable API endpoints, bypassing the front-end authentication logic entirely. Because the backend processes run with high-level system permissions, reaching these internal routines allows an attacker to achieve unauthenticated remote code execution with root privileges on the underlying operating system.

Exploitation requires no existing user credentials, valid session state, or user interaction. Furthermore, the vulnerability impacts default installations regardless of specific system configurations or active feature sets.

Blast Radius and Architectural Impact

Cisco ISE and ISE-PIC function as the centralized policy, network access control (NAC), and identity orchestration core for enterprise environments. Because these appliances interface directly with Active Directory, RADIUS/TACACS+ servers, network switches, VPN gateways, and wireless controllers, compromising an ISE node grants an attacker deep control over the organization’s network perimeter and internal segmentation model.

With root-level execution on an ISE appliance, an adversary can:

• Manipulate Network Access Policies: Modify RADIUS responses to grant rogue devices full network access or downgrade security policies for specific users.
• Harvest Credentials: Intercept authentication traffic passing through the access management infrastructure.
• Cover Threat Activity: Leverage root permissions to modify system binaries, clear audit trails, and alter local log files directly on the underlying filesystem, effectively hiding presence from local security tools.
• Pivot Centrally: Use the trusted position of the ISE node to attack adjacent enterprise infrastructure and management network segments.

Because root access allows attackers to erase or alter local system logs, relying solely on on-box telemetry to confirm a breach is insufficient.

Active Exploitation and Context

Cisco discovered CVE-2026-76460 during the resolution of an internal Technical Assistance Center (TAC) support case, subsequently confirming active zero-day exploitation in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) has formally added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.

This advisory arrives alongside a cluster of other high-severity disclosures affecting Cisco ISE, including two additional CVSS 10.0 vulnerabilities and three distinct remote code execution flaws scoring up to 9.9. Combined with the recent attacks on Cisco Secure Email Gateways, threat actors are aggressively targeting edge-facing and security-infrastructure management appliances—assets that offer high privileges and limited visibility for endpoint detection tools.

Remediation and Forensic Guidance

Cisco has released permanent software updates to address CVE-2026-76460. Because no software workarounds exist that fully eliminate the underlying vulnerability, organizations must apply the appropriate maintenance patch immediately:

• ISE / ISE-PIC 3.1: Apply Patch 12
• ISE / ISE-PIC 3.2: Apply Patch 11
• ISE / ISE-PIC 3.3: Apply Patch 12
• ISE / ISE-PIC 3.4: Apply Patch 7
• ISE / ISE-PIC 3.5: Apply Patch 4

Note: Cisco ISE 3.0 has reached End of Software Maintenance. Organizations still running version 3.0 receive no patch and must migrate to a supported release family immediately.

Temporary Mitigation

If immediate patching is impossible, network administrators should deploy Infrastructure Access Control Lists (iACLs) on upstream routers or firewalls. These iACLs must restrict administrative management and control-plane traffic to trusted, dedicated management subnets, blocking untrusted external and internal traffic from reaching the ISE web management interface.

Incident Response and Investigation

Given that root-level access enables attackers to tamper with local system logging, security teams should perform the following forensic steps across all nodes in distributed deployments:

1. Audit Web Access Telemetry: Examine web server and API access logs across every ISE deployment node for anomalous user sessions, unusual HTTP request payloads, or unauthenticated requests hitting administrative API routes.
2. Review Out-of-Band Logs: Check external syslog servers, SIEM platforms, and perimeter firewall logs for suspicious egress connections, unexpected data transfers, or unusual HTTP/HTTPS POST activity originating from ISE management interfaces.
3. Reimage Compromised Nodes: If evidence of unauthorized command execution or log alteration is identified, Cisco strongly recommends completely reimaging the affected nodes, applying the fixed software release, and restoring system configurations from a known-clean backup created prior to the intrusion.