# Cisco Patches a Maximum-Severity Zero-Day in Its Identity Services Engine

Page: https://hirantha.me/blog/cisco-patches-a-maximum-severity-zero-day-in-its-identity-services-engine
Published: 2026-09-18
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: cisco, identity services engine, cve-2026-76460, zero-day, authentication bypass

> A maximum-severity flaw lets attackers skip login entirely on Cisco's Identity Services Engine, and CISA says federal agencies must patch by September 19.

## The flaw lets attackers walk past the login screen

Cisco has confirmed that a maximum-severity vulnerability in its Identity Services Engine (ISE) is being exploited right now, and the company is telling every customer running the product to patch immediately. There is no workaround. The only fix is the update.

ISE is the system many large networks use to decide who and what gets access: it authenticates users and devices before they reach internal resources, which is exactly why a hole in its own login process is so damaging. The vulnerability, tracked as CVE-2026-76460, carries a CVSS score of 10.0, the maximum possible.

## How the bypass works

The root cause is an API endpoint on the ISE management interface that fails to properly check authentication. An attacker who is not logged in, and does not need any valid credentials, can send a specially crafted request straight to that endpoint and get treated as if they had authenticated normally. From there, successful exploitation hands the attacker command execution with root privileges on the device, the highest level of control the system has. That level of access would let an intruder alter network access policy, pull data on every device that has authenticated through the box, or erase log entries to cover their tracks.

Cisco's advisory says it is aware of active exploitation but has not disclosed who is behind it, how many organizations have been hit, or what the attackers have done with the access. Independent security outlets reporting on the flaw have not identified the threat actor either.

## What's affected and how to fix it

The bug affects Cisco ISE and its companion product, ISE Passive Identity Connector (ISE-PIC), across releases 3.1 through 3.5. Cisco has published fixed versions for each affected release:

| Release | Fixed in |
|---|---|
| 3.1 | Patch 12 |
| 3.2 | Patch 11 |
| 3.3 | Patch 12 |
| 3.4 | Patch 7 |
| 3.5 | Patch 4 |

Because there is no mitigation short of patching, administrators who cannot update immediately should at minimum restrict network access to the ISE management interface to trusted management networks only, which reduces the pool of people who can reach the vulnerable endpoint at all.

## Checking for prior compromise

Because the bypass happens at the authentication layer, a successful attack does not necessarily look unusual in normal traffic logs. Cisco has pointed administrators to the ISE Kong access log, where requests that used the flaw show up under usernames that would not appear in a legitimate admin session. Reviewing that log for unfamiliar or clearly fake usernames is the fastest way to tell whether a device has already been touched, before assuming that a delayed patch means a device is still clean.

## Why the clock is running

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026. That listing requires U.S. federal civilian agencies to apply the fix by September 19, a three-day window that reflects how CISA treats vulnerabilities it already knows are being used in attacks, not how it treats routine bugs.

That deadline is a binding rule for federal agencies specifically, but it is not a signal that anyone else has more time. Cisco's own advisory already describes exploitation in the wild, which means every organization running an affected ISE release is a potential target today, regardless of which sector it's in.

## Why ISE specifically is a high-value target

ISE is not a typical server. It sits at the point where a network decides whether a laptop, phone or piece of hardware is allowed onto the network at all, which means it usually holds the policy rules, device inventory and authentication logs for everything connecting through it. A vulnerability in most applications gives an attacker a foothold; a vulnerability in the access-control system itself can give an attacker a way to grant footholds to itself anywhere else on the network. That is what makes a CVSS 10.0 rating on this specific product harder to write off as a routine severe bug, even in a year that has already produced its share of critical Cisco advisories.

## What this means in practice

If your organization runs Cisco ISE or ISE-PIC on any of the 3.1 through 3.5 releases, treat this as an incident-response-track item rather than routine patch-cycle work: apply the fixed patch for your release, then check the ISE Kong access log for signs the box was already reached before you patched it. Because ISE typically sits in front of everything else on a network, a compromised instance is a starting point for further attacks rather than an isolated problem, so confirming it's clean is as important as closing the hole itself.

## Questions

**What is CVE-2026-76460?**
It is a maximum-severity, CVSS 10.0 authentication bypass in Cisco Identity Services Engine and ISE Passive Identity Connector that lets an unauthenticated attacker send a crafted request to an API endpoint and gain root-level command execution on the device.

**Which Cisco ISE versions are affected?**
Releases 3.1 through 3.5 of Identity Services Engine and ISE-PIC. Cisco has published fixes in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.

**Is there a workaround if I can't patch right away?**
No. Cisco says there is no workaround, so restricting access to the management interface and reviewing logs are the only stopgaps until the patch is applied.

**How do I check if my ISE has already been attacked?**
Cisco recommends reviewing the ISE Kong access log for requests tied to unexpected or clearly fake usernames, since a successful exploit does not otherwise stand out from normal admin traffic.

**Does the September 19 deadline only apply to government agencies?**
The CISA deadline is binding only for U.S. federal civilian agencies, but Cisco has already confirmed exploitation in the wild, so any organization running an affected ISE release should patch on the same urgent timeline.

## Sources

- [Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks](https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html), The Hacker News
- [Cisco warns of max severity ISE zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/), BleepingComputer
- [CISA warns of Cisco Identity Services Engine authentication bypass vulnerability (CVE-2026-76460)](https://threatprotect.qualys.com/2026/09/17/cisa-warns-of-cisco-identity-services-engine-authentication-bypass-vulnerability-cve-2026-76460/), Qualys ThreatPROTECT