Cisco has announced the discovery of a critical zero-day vulnerability, CVE-2026-76460, affecting both its Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). This flaw, officially rated 10.0 on the CVSS scale, is being actively exploited by attackers. It permits unauthenticated remote actors to bypass authentication controls via a vulnerable API endpoint. Once inside, they can access ISE’s web management interface without credentials.
Why This Vulnerability Is So Dangerous
The flaw enables attackers to achieve remote code execution with root privileges on ISE systems. Root access grants full administrative control: attackers may manipulate configurations, deploy malicious software, establish persistent footholds, exfiltrate credentials, or pivot laterally across networks. Importantly, all supported configurations of Cisco ISE and ISE-PIC are exposed to risk. Version 3.0 of ISE is also affected, though it has already reached end of software maintenance, meaning it will not receive new fixes.
Patches, Mitigation, and Detection Steps
Cisco has issued updates that remediate the vulnerability in several supported versions. The fixed releases include ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Organizations running version 3.0 are urged to upgrade to a supported version containing the patch.
Since there’s presently no workaround that fully removes risk, Cisco recommends applying temporary defenses for those unable to patch immediately. These include using infrastructure access control lists (iACLs) to limit which systems can reach vulnerable ISE management interfaces or control-plane traffic. Only trusted systems should be granted management interface access. However, such mitigations are stopgap—they do not correct the underlying flaw.
For detecting signs of exploitation, Cisco advises reviewing access logs for unusual usernames or unexpected API activity. In distributed ISE deployments, each node must be checked because any accessible node could be targeted. An example command for this is “show logging application ise-kong/access.log | include dummyuser”. Administrators should also gather support bundles with debug logs, monitor external network activity from ISE nodes, and examine firewall or network logs for suspicious outbound traffic. If compromise is confirmed or strongly suspected, Cisco recommends reimaging the affected node and restoring it from a known-good backup.
The flaw was identified during a support investigation by Cisco’s Technical Assistance Center (TAC), rather than reported through traditional vulnerability disclosure channels.
Enterprises that rely on Cisco ISE for network access control, device and user authentication, and visibility into asset health are exposed to particularly severe risk, due to the privileged access this system holds. ISE plays a key role in enforcing policy compliance and securing devices across internal networks; an attacker compromising ISE gains potent power. With no ideal workaround, organizations must act swiftly.
What this means: this vulnerability represents a serious threat to any organization using Cisco ISE or ISE-PIC. Patch deployment should be among the top priorities for security teams. The lack of effective temporary fixes underscores how critical strong change and asset management are—those still on older or unsupported versions face especially elevated risk. Ahead: monitoring for unusual logs, strengthening network segmentation and access controls, and ensuring backup and reimaging procedures are in place. Observing how Cisco responds, how exploit methods evolve, and whether similar API endpoint authentication flaws show up in other network infrastructure tools will be essential in the months ahead.
