The short answer
An unpatched Cisco ISE can be taken over by a single crafted request — no login, no credentials. CVE-2026-76460 (CVSS 10.0) is an authentication-bypass flaw in an ISE API endpoint that chains into arbitrary command execution as root. Cisco confirmed active exploitation, CISA added it to the Known Exploited Vulnerabilities catalog in September 2026, and Cisco says there is no workaround. The fix is to upgrade ISE to a patched release immediately.
For US and EU teams, the sting is where the flaw lives: ISE is the system that decides who and what is allowed onto the network, so owning it means owning access policy itself. Appliances like this are trusted implicitly and rarely make it into a test scope — which is exactly why they belong in one. That is the posture we build into a penetration test and security audit: treat the systems meant to enforce your security as attack surface and prove they hold up.
What Cisco disclosed
Cisco Identity Services Engine (ISE) is the policy brain of enterprise network access control. It authenticates users and devices, enforces who can reach which network segment, and drives 802.1X, guest access, posture checks, and segmentation. That role makes it one of the most sensitive chokepoints in a corporate architecture: an attacker who controls ISE does not just breach one server, they gain a lever over the rules that govern access to everything else.
In September 2026, Cisco disclosed CVE-2026-76460, a vulnerability caused by insufficient authentication controls on a specific API endpoint in ISE and the ISE Passive Identity Connector (ISE-PIC). An unauthenticated, remote attacker can send a crafted request to that endpoint, bypass the web-based management interface, and ultimately execute commands with root privileges on the underlying system. Cisco rated it CVSS 10.0 — the top of the scale — noted that both ISE and ISE-PIC are affected regardless of device configuration, and confirmed there is no workaround.
Cisco’s PSIRT also stated it is aware of active exploitation. Shortly after disclosure, CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog, which triggers a mandatory remediation deadline for US federal civilian agencies and serves as a strong signal to everyone else. KEV inclusion means the attacks are confirmed, not theoretical — and because a successful exploit runs as root, an intruder can also hide or delete the very indicators a defender would look for.
Why one request becomes root
What makes this bug so severe is the complete absence of prerequisites. There is no password to guess, no session to hijack, no phishing lure a user must click. The attacker sends one crafted request to an API endpoint that fails to enforce authentication, and that single failure opens the management surface. Because the exploited process runs with high privilege, the chain ends in command execution as root on the host — a full compromise of the device from an unauthenticated starting point.
That combination — unauthenticated, remote, no user interaction, root-level outcome — is why the CVSS score reaches 10.0 and why exploitation followed disclosure so quickly. An attacker who owns ISE owns the system that decides network access: they can create or alter access policy, authorize their own devices, disable segmentation that was containing them, read the identity and posture data ISE holds, and use the box as a durable, trusted foothold to move laterally. For a security control, that is the worst-case failure, because the breach happens inside the mechanism the organization installed to prevent exactly this.
There is no feature flag or policy setting that neutralizes CVE-2026-76460, which is why Cisco is explicit that no workaround exists. The vulnerable code is in the authentication path of the API itself. Cisco released fixed releases across the supported trains — ISE and ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 — and upgrading to one of them is the only true remediation. As an interim measure while you schedule the update, infrastructure access control lists (iACLs) that restrict traffic to the ISE management and API interfaces can block the remote path an attacker needs.
What it means for US & EU software teams
The first lesson is that the identity control is part of your attack surface, not a substitute for securing it. Teams trust the security stack implicitly — the NAC, the identity server, the firewall — and leave those devices out of the assessments they run against their own applications. But an internet- or management-reachable box with a pre-auth path to root is exactly what an attacker looks for first, and here it grants control of access policy in one step. The same edge-hardening discipline you apply to your cloud and DevOps platform — least privilege, tight network exposure, fast patch pipelines, and monitoring — has to extend to identity and network appliances, not stop at the code you wrote.
The second lesson is about patch velocity as an operational capability. When a bug goes from disclosure to CISA KEV in short order, is rated 10.0, and has no workaround, the only variable you control is how quickly you can identify affected nodes and roll the fix. Organizations that keep a current asset inventory, know which appliances expose management or API interfaces, and can schedule an out-of-band update within hours will close this before it is used against them; those that discover their exposure during an incident will not. That readiness is a process to build in advance, not to improvise under fire.
Third, this is a compliance and reporting event, not just an IT ticket. ISE governs access to systems that routinely handle personal and regulated data, so a root compromise of it lands squarely within GDPR, NIS2, and DORA expectations for access control and prompt, documented remediation in the EU, and within HIPAA and SOC 2 obligations for US teams in health and finance. Being able to show which nodes were affected, when you patched, whether you applied iACLs in the interim, and what evidence of exploitation you checked for is the record auditors and regulators will ask for first.
What to do now
- Inventory every ISE node. Find all Cisco ISE and ISE-PIC deployments, including standby, secondary, and lab instances — the ones missing from your list are the ones that stay unpatched.
- Patch immediately. Apply the fixed release for your train — 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, or 3.5 P4. There is no workaround, so treat this as an emergency change, not a scheduled maintenance window.
- Restrict access in the interim. Until every node is patched, use iACLs to limit traffic to ISE management and API interfaces to trusted administrative networks, cutting off the remote path an attacker needs.
- Hunt for exploitation. Review ISE and network logs for unexpected API calls, new or altered access policies, unfamiliar authorized devices, and root-level activity. If a node was reachable and unpatched, investigate on the assumption it may already be compromised — and remember a root attacker may have tampered with logs.
- Contain and rotate, then test. Rotate credentials, certificates, and secrets ISE held or could observe, validate the integrity of your access policies, and add identity and network-access appliances to the scope of your next penetration test so the next KEV addition triggers action automatically.
Frequently asked questions
What is CVE-2026-76460?
It is a critical authentication-bypass vulnerability (CVSS 10.0) in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Insufficient authentication controls on a specific endpoint let an unauthenticated, remote attacker send a crafted request, bypass the web-based management interface, and ultimately execute commands with root privileges. Both products are affected regardless of configuration, and there is no workaround.
How is the flaw exploited?
The attack needs no authentication and no interaction from anyone on the target side. An attacker sends a specially crafted request to a vulnerable API endpoint that fails to enforce authentication; that bypass opens the management surface, and successful exploitation ends in command execution as root. Because ISE decides who and what may connect to the network, controlling it means controlling network access policy.
Which versions are affected, and what are the fixes?
Cisco ISE and ISE-PIC are affected regardless of configuration. Cisco released fixed releases: ISE/ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. There is no workaround; applying the fixed release is the only remediation. As an interim shield, iACLs that restrict traffic to the affected device can prevent remote exploitation.
Is CVE-2026-76460 being exploited in the wild?
Yes. Cisco’s PSIRT confirmed it is aware of active exploitation, and CISA added the flaw to the U.S. Known Exploited Vulnerabilities catalog in September 2026, which obliges federal civilian agencies to remediate on a set timeline. KEV inclusion means confirmed attacks, so every organization running an affected ISE deployment should treat the patch as an emergency.
What should teams do right now?
Inventory every ISE and ISE-PIC node, including standby and lab instances, and apply the fixed release for your train immediately. While you patch, use iACLs to restrict management and API access to trusted networks. Review logs for unexpected API calls, altered access policies, and root-level activity, and assume compromise if the box was reachable and unpatched. Rotate credentials and certificates ISE held, and add identity and network appliances to your next penetration test.
Sources
SecurityWeek — Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Security Affairs — CISA Adds Acronis Backup, Cisco ISE, and Google Pixel Flaws to KEV Catalog
CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog