Cisco Warns of Maximum-Severity ISE Zero-Day Exploited in Active Attacks

A maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) is currently under active, real-world exploitation. Tracked as CVE-2026-76460 with a CVSS score of 10.0, the critical flaw allows an unauthenticated remote attacker to bypass authentication controls entirely due to insufficient permission handling on an API endpoint.

Because Cisco ISE functions as the core control plane for enterprise network access policy, a complete authentication bypass gives threat actors a direct path to bypass perimeter controls and compromise core network infrastructure.

Attack Mechanics and Blast Radius

The vulnerability stems from improper access enforcement on an administrative API endpoint (CWE-648 class weakness). The assigned CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) underscores the severe threat profile: the attack is remotely reachable over the network, requires zero initial privileges, demands no user interaction, and carries low execution complexity.

Crucially, the metric indicates a changed scope (S:C). In practice, this means an adversary who successfully exploits the authentication bypass on the ISE API endpoint is not restricted to the vulnerable application container itself—they can leverage those authorization rights to impact downstream network infrastructure, manipulate access control lists (ACLs), or grant unauthorized network privileges enterprise-wide.

The flaw affects Cisco Identity Services Engine versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0, as well as Cisco Identity Services Engine Passive Identity Connector (ISE-PIC) version 3.1.0.

Operational Impact

In modern enterprise architectures, Cisco ISE handles zero-trust access, network access control (NAC), and AAA (authentication, authorization, and accounting) services for wired, wireless, and VPN entry points. An unauthenticated threat actor exploiting CVE-2026-76460 can alter network policy enforcement, issue elevated access credentials, or turn off access logging. Given that active exploitation is already occurring, any organization exposing ISE API endpoints directly to untrusted networks or broadly exposed internal segments faces an immediate threat of lateral movement and full domain compromise.

Recommended Remediation

Security teams running affected instances of Cisco Identity Services Engine or ISE-PIC must prioritize immediate mitigation:

• Apply Vendor Updates: Deploy the permanent software fixes released in Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5.
• Restrict Interface Exposure: Immediately isolate Cisco ISE management and API interfaces, ensuring they are not reachable from the public internet or untrusted internal VLANs. Access should be tightly limited to trusted administrative jump hosts.
• Inspect API Logs: Search ISE access logs for unauthorized HTTP/REST API requests to administrative endpoints, particularly unauthenticated POST or PUT calls originating from unexpected IP addresses.