Cisco ISE Zero-Day Is a Perfect 10: Root Access, No Credentials, No Workaround
Cisco ISE Zero-Day Is a Perfect 10: Root Access, No Credentials, No Workaround
Section titled “Cisco ISE Zero-Day Is a Perfect 10: Root Access, No Credentials, No Workaround”Cisco shipped an emergency patch for an authentication bypass in Identity Services Engine (ISE) that scores a perfect 10.0 on the CVSS scale and is already under active attack (Cisco advisory, 2026). No workaround exists (Cisco advisory, 2026). Every network that runs ISE for access control should treat this as a break-glass event.
The flaw in one paragraph
Section titled “The flaw in one paragraph”The vulnerability is tracked as CVE-2026-76460 with the advisory ID cisco-sa-ISE-ABP-VNSW7Tn5. Cisco published it on September 16, 2026 (Cisco advisory, 2026). The root cause is “insufficient authentication control” on an ISE API endpoint (Dark Reading, 2026).
An unauthenticated, remote attacker sends a crafted request to the affected API endpoint (The Hacker News, 2026). A successful exploit bypasses the web-based management interface and delivers command execution with root privileges (The Register, 2026). No credentials are required (Petri, 2026).
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means network-based, low complexity, no privileges, and a changed security scope (SOCRadar, 2026). The flaw affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of device configuration (Cisco advisory, 2026; BitSight, 2026).
”Actively exploited” is confirmed, not precautionary
Section titled “”Actively exploited” is confirmed, not precautionary”Cisco’s Product Security Incident Response Team stated it is aware of active exploitation and urged customers to install the fix (The Register, 2026). Cisco found the bug while resolving a support case through TAC (Rescana, 2026). That discovery path is the classic signature of a breach already in progress.
CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog on the same day (Rescana, 2026). Federal agencies had until September 19, 2026 to remediate (Rescana, 2026). CISA marks the incident as requiring forensic triage (SecurityWeek, 2026). Known ransomware campaign use is listed as unknown (Rescana, 2026).
The endpoint and the request shape stay unpublished. Cisco withholds those details because the flaw is live (Rescana, 2026). That protects defenders a little and attackers almost nothing, because weaponized exploits now circulate in closed groups (SOC Prime, 2026).
Why ISE compromise is worse than a server compromise
Section titled “Why ISE compromise is worse than a server compromise”ISE is not a random appliance. ISE sits at the center of network access control (Petri, 2026). It runs identity-based policies, device posture checks, and authentication workflows that decide who gets on the network (BitSight, 2026).
Root on ISE means attackers control the identity and network-control infrastructure (Rescana, 2026). They can grant themselves access, weaken posture checks, and move laterally as trusted devices (SecurityWeek, 2026). One crafted request bypasses the management plane, so exposure control on the device itself is the only stopgap (Cisco advisory, 2026).
This is the third maximum-severity ISE disclosure in two years. CVE-2025-20281 and CVE-2025-20337 both scored 10.0 and both allowed unauthenticated remote code execution (SOC Prime, 2026). Identity platforms keep being the target because they dominate what follows (Rescana, 2026).
What to do this week
Section titled “What to do this week”-
Patch ISE and ISE-PIC now. Use the Fixed Software table in the advisory for your release train, including the hardening release published the same day (Cisco advisory, 2026). The emergency releases exist because exploitation is confirmed (SecurityWeek, 2026).
-
Assume compromise if you cannot prove otherwise. CISA requires forensic triage, not just a patch (Rescana, 2026). Pull logs from the management interface and the API endpoint before the evidence window closes (SOC Prime, 2026).
-
Restrict the management plane. No workaround exists, so reduce exposure. Put ISE management interfaces behind firewalls and VPN-only access until patched (Cisco advisory, 2026).
-
Know the blast radius. Posture checks run on this box (BitSight, 2026). After patching, audit device and user posture for unapproved exceptions an attacker may have minted (Petri, 2026).
-
Watch the API chatter. The vulnerable endpoint is unnamed, but the pattern is not. Look for crafted API requests to ISE that predate the patch and for new SSH or config-change activity afterward (Dark Reading, 2026).
The takeaway
Section titled “The takeaway”A perfect-10 score, root-level impact, and confirmed exploitation make CVE-2026-76460 the most urgent patch of the week (SecurityWeek, 2026). Treat the September 19 federal deadline as your own. Patch both ISE and ISE-PIC, segment the management plane, and investigate before you declare the incident closed (Cisco advisory, 2026; Rescana, 2026).