The flaw lets attackers walk past the login screen
Cisco has confirmed that a maximum-severity vulnerability in its Identity Services Engine (ISE) is being exploited right now, and the company is telling every customer running the product to patch immediately. There is no workaround. The only fix is the update.
ISE is the system many large networks use to decide who and what gets access: it authenticates users and devices before they reach internal resources, which is exactly why a hole in its own login process is so damaging. The vulnerability, tracked as CVE-2026-76460, carries a CVSS score of 10.0, the maximum possible.
How the bypass works
The root cause is an API endpoint on the ISE management interface that fails to properly check authentication. An attacker who is not logged in, and does not need any valid credentials, can send a specially crafted request straight to that endpoint and get treated as if they had authenticated normally. From there, successful exploitation hands the attacker command execution with root privileges on the device, the highest level of control the system has. That level of access would let an intruder alter network access policy, pull data on every device that has authenticated through the box, or erase log entries to cover their tracks.
Cisco's advisory says it is aware of active exploitation but has not disclosed who is behind it, how many organizations have been hit, or what the attackers have done with the access. Independent security outlets reporting on the flaw have not identified the threat actor either.
What's affected and how to fix it
The bug affects Cisco ISE and its companion product, ISE Passive Identity Connector (ISE-PIC), across releases 3.1 through 3.5. Cisco has published fixed versions for each affected release:
| Release | Fixed in |
|---|---|
| 3.1 | Patch 12 |
| 3.2 | Patch 11 |
| 3.3 | Patch 12 |
| 3.4 | Patch 7 |
| 3.5 | Patch 4 |
Because there is no mitigation short of patching, administrators who cannot update immediately should at minimum restrict network access to the ISE management interface to trusted management networks only, which reduces the pool of people who can reach the vulnerable endpoint at all.
Checking for prior compromise
Because the bypass happens at the authentication layer, a successful attack does not necessarily look unusual in normal traffic logs. Cisco has pointed administrators to the ISE Kong access log, where requests that used the flaw show up under usernames that would not appear in a legitimate admin session. Reviewing that log for unfamiliar or clearly fake usernames is the fastest way to tell whether a device has already been touched, before assuming that a delayed patch means a device is still clean.
Why the clock is running
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026. That listing requires U.S. federal civilian agencies to apply the fix by September 19, a three-day window that reflects how CISA treats vulnerabilities it already knows are being used in attacks, not how it treats routine bugs.
That deadline is a binding rule for federal agencies specifically, but it is not a signal that anyone else has more time. Cisco's own advisory already describes exploitation in the wild, which means every organization running an affected ISE release is a potential target today, regardless of which sector it's in.
Why ISE specifically is a high-value target
ISE is not a typical server. It sits at the point where a network decides whether a laptop, phone or piece of hardware is allowed onto the network at all, which means it usually holds the policy rules, device inventory and authentication logs for everything connecting through it. A vulnerability in most applications gives an attacker a foothold; a vulnerability in the access-control system itself can give an attacker a way to grant footholds to itself anywhere else on the network. That is what makes a CVSS 10.0 rating on this specific product harder to write off as a routine severe bug, even in a year that has already produced its share of critical Cisco advisories.
What this means in practice
If your organization runs Cisco ISE or ISE-PIC on any of the 3.1 through 3.5 releases, treat this as an incident-response-track item rather than routine patch-cycle work: apply the fixed patch for your release, then check the ISE Kong access log for signs the box was already reached before you patched it. Because ISE typically sits in front of everything else on a network, a compromised instance is a starting point for further attacks rather than an isolated problem, so confirming it's clean is as important as closing the hole itself.
