Cisco disclosed a maximum-severity zero-day vulnerability in its Identity Services Engine on September 16, 2026, allowing attackers to bypass API authentication and gain root-level access without credentials or user interaction. The flaw, tracked as CVE-2026-76460, is already under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog on the same day. Organizations running ISE or ISE-PIC versions 3.1 through 3.5 should apply patches immediately.<\/p>\n
CVE-2026-76460 is an authentication bypass vulnerability in an API endpoint within Cisco Identity Services Engine, the company’s network access control and zero-trust solution. The flaw stems from insufficient authentication control on an affected API endpoint, allowing an attacker to send a crafted request that bypasses the web-based management interface entirely.<\/p>\n
Successful exploitation gives the attacker root privileges and command execution on vulnerable instances. No authentication or user interaction is required, making the vulnerability especially dangerous in environments where the management interface is exposed to untrusted networks.<\/p>\n
The danger of CVE-2026-76460 extends well beyond the affected device. ISE serves as the access control backbone for many organizations, determining which users and devices can connect to a network and what resources they can reach after connecting. Other Cisco APIs rely on ISE for authentication and access decisions, so an attacker who compromises ISE can effectively replace the security gatekeeper with a trusted imposter.<\/p>\n
Once ISE is compromised, the applications and network services that rely on its access decisions may start authorizing unauthorized users or devices.<\/p>\n
The ISE zero-day is not an isolated incident for Cisco. Two similar vulnerabilities were disclosed earlier in 2026, both involving insufficient authentication on API endpoints:<\/p>\n
As organizations expose more APIs to support web application interfaces, authentication and access controls are sometimes omitted or simplified, creating direct paths to sensitive internal systems.<\/p>\n
As of the disclosure, the identity of the threat actors exploiting CVE-2026-76460 and the scale of the activity remain unclear. Cisco released a brief statement that mirrored the advisory language but did not address questions about attribution or exploitation volume.<\/p>\n
CVE-2026-76460 affects both ISE and ISE Passive Identity Connector (ISE-PIC) regardless of device configuration. Cisco has released patches for versions 3.1 through 3.5 of both products. Version 3.0 is no longer supported; customers running that version must upgrade to a fixed release.<\/p>\n
Cisco recommends deploying infrastructure access control lists (iACLs) to restrict management and control plane traffic to the affected devices as a temporary mitigation. iACLs can block remote exploitation by limiting which sources can reach the vulnerable API endpoints.<\/p>\n
However, Cisco cautioned that any workaround is only a temporary stopgap. Organizations should move to a fixed version of ISE or ISE-PIC as soon as possible. Successful exploitation grants root privileges, allowing attackers to delete or conceal evidence of compromise and remove indicators of compromise (IoCs) from the device itself.<\/p>\n
Because on-device logs may be tampered with, Cisco strongly recommends cross-checking network logs and external firewall logs for suspicious activity. Signs to look for include unexpected outbound uploads from the affected device to external IP addresses, and inbound downloads from known malicious IP addresses.<\/p>\n
The recurring pattern of API authentication bypasses across Cisco products highlights a common gap in enterprise security programs. API endpoints that were never meant to be externally reachable are sometimes exposed during cloud migrations, management interface overhauls, or third-party integrations, and the authentication layer that protected them internally is stripped out in the process.<\/p>\n
Security teams should audit every API endpoint exposed by critical infrastructure components and confirm that each one enforces authentication and access control independently of the underlying system’s own trust mechanisms. Relying on a single component to gate access for an entire network creates a single point of failure that, once compromised, undermines every downstream protection.<\/p>\n
CVE-2026-76460 is a maximum-severity authentication bypass vulnerability in Cisco Identity Services Engine (ISE) that allows an attacker to gain root-level access by sending a crafted request to an affected API endpoint. No authentication or user interaction is required.<\/p>\n
CVE-2026-76460 affects Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) regardless of configuration. Patches are available for versions 3.1 through 3.5; version 3.0 is no longer supported and must be upgraded.<\/p>\n
Apply the Cisco patches for ISE and ISE-PIC as soon as possible. As a temporary measure, deploy infrastructure access control lists (iACLs) to limit management traffic to affected devices. Also review external network and firewall logs for unexpected uploads or downloads involving the affected systems, since on-device logs may be altered by an attacker.<\/p>\n