Cisco pushed out an emergency security advisory on September 16, 2026, for a flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that scores a perfect 10.0 on the CVSS scale. The bug, tracked as CVE-2026-76460, lets an attacker with no credentials at all send a crafted request to an API endpoint and walk past the authentication checks guarding the management interface. Cisco’s own Product Security Incident Response Team says it was already seeing exploitation before the patch shipped. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog within two days and gave federal civilian agencies a one-day window to fix it.
That’s a strikingly short runway for a product that sits at the center of enterprise network access control. ISE is the system that decides who and what gets onto a corporate network, so a break in its front door has knock-on effects for every device, user, and policy behind it. This is now the third maximum-severity, actively exploited zero-day CISA has forced federal agencies to patch inside a matter of days this quarter, following the Arista VeloCloud Orchestrator flaw and the SonicWall SMA1000 bug. Below is what’s confirmed about the Cisco ISE flaw, what it means for the thousands of organizations running the platform, and where the pattern of CVSS-10 identity infrastructure bugs is heading next.
What CVE-2026-76460 Actually Is
CVE-2026-76460 is an authentication bypass rooted in insufficient authentication control on an API endpoint inside the ISE web management interface, a flaw class some trackers classify under CWE-648, incorrect use of privileged APIs. Cisco’s advisory, published under the identifier cisco-sa-ISE-ABP-VNSW7Tn5, states the issue affects ISE and ISE-PIC regardless of how the device is configured. That detail matters: there’s no obscure setting or optional module you can disable to sidestep the bug. Every deployment running an affected release is exposed by default.
The CVSS 3.1 vector reported for the flaw is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Translated, that means the bug is reachable remotely over the network, takes low skill to trigger, needs zero privileges or user clicks, and can cross a security boundary to fully compromise confidentiality, integrity, and availability. That combination of factors is exactly why it lands at the ceiling of the scoring system rather than merely near it.
What an Attacker Actually Gets
Multiple outlets covering Cisco’s advisory, including The Hacker News, report that successful exploitation can escalate all the way to command execution with root privileges on the underlying appliance. That’s a meaningfully worse outcome than a typical authentication bypass, which might only expose a read-only dashboard. Root access on an ISE box can mean the attacker reads stored credentials and secrets, rewrites access policies, creates rogue administrative accounts, and disrupts the authentication service that other network gear relies on to make access decisions. Some secondary reporting also describes the ability to wipe logs post-compromise, though that detail comes from inferred post-exploitation behavior rather than Cisco’s own advisory text.
Timeline: Disclosure, Exploitation, and a One-Day Deadline
Cisco’s disclosure landed on a Wednesday, September 16, and coverage from CyberScoop and other outlets followed within 24 hours describing it as Cisco’s second actively exploited zero-day that week. CISA added the CVE to its Known Exploited Vulnerabilities catalog around September 18, setting a remediation deadline of September 19 for Federal Civilian Executive Branch agencies, according to reporting from MeriTalk. A one-day patch window is aggressive even by CISA’s standards, and it signals how seriously the agency weighed the combination of a maximum CVSS score, no available workaround, and confirmed in-the-wild exploitation.
Cisco has not published the identity of the attacker or a count of compromised organizations, and no outlet has confirmed a named threat group tied to the campaign. What is established is that PSIRT flagged active exploitation prior to the patch shipping, which puts CVE-2026-76460 in the zero-day category rather than the more common pattern of researchers finding a bug before criminals do. GBHackers reported the same active-exploitation timeline, noting that Cisco’s advisory arrived after attackers were already probing the flaw rather than ahead of any public proof-of-concept.
Which Cisco ISE Versions Need Patching
Cisco’s advisory covers release branches 3.0 through 3.5, though the 3.0 line is no longer supported, meaning customers still on it need to migrate to a patched branch rather than wait for a backported fix. The company also recommends reimaging any node where compromise is suspected rather than trusting an in-place upgrade to fully remove an attacker’s foothold.
| ISE / ISE-PIC Release Train | Fixed Version | Status |
|---|---|---|
| 3.1 | Patch 12 | Supported, patch available |
| 3.2 | Patch 11 | Supported, patch available |
| 3.3 | Patch 12 | Supported, patch available |
| 3.4 | Patch 7 | Supported, patch available |
| 3.5 | Patch 4 | Supported, patch available |
| 3.0 and earlier | None (end of support) | Migrate to a patched branch |
There’s no workaround listed for organizations that can’t patch immediately. Cisco’s guidance for that gap is to restrict administrative and API access to trusted management networks and to watch authentication and system logs for requests that don’t match normal admin behavior, which is a weaker substitute for patching but the only option available in the interim.
Checking Your Patch Level
Administrators can confirm the running ISE version and patch level from the CLI before planning the upgrade window:
ise-admin# show version
ise-admin# show application version ise
# Compare the reported patch number against Cisco's
# fixed releases for your 3.x branch before scheduling
# the upgrade or reimage.A Pattern: Cisco ISE’s Run of Maximum-Severity Bugs
CVE-2026-76460 doesn’t stand alone. Cisco ISE carried two other CVSS 10.0 disclosures in June 2025, tracked as CVE-2025-20337 and CVE-2025-20338. The available reporting doesn’t establish that all three bugs share a single root cause, so it would be a stretch to call this one coding defect resurfacing. But three maximum-severity findings in the same identity and policy-enforcement product line within roughly fourteen months is still a pattern worth watching, especially because ISE sits in a privileged position on the network by design. A flaw in a system built to gatekeep access is a different category of risk than the same flaw in a peripheral tool.
Why Identity Infrastructure Draws This Much Attention
Products like ISE, and the SD-WAN and VPN gateways that have also taken CVSS-10 hits this year, share a structural weakness: they’re internet-facing or network-privileged by necessity, they hold credentials and policy data attackers want, and they’re complex enough that authentication logic can get buried in rarely-audited API code paths. Coverage from CSO Online notes this was Cisco’s second critical zero-day disclosed that same week, underscoring how much scrutiny identity and access products are currently drawing from both researchers and attackers.
How 2026’s Wave of CVSS 9.8-10.0 Zero-Days Compares
Cisco ISE joins a crowded list of network and infrastructure products that have taken maximum or near-maximum severity hits this year, each landing on CISA’s Known Exploited Vulnerabilities catalog with a short federal remediation clock attached.
| Vulnerability | Product Category | CVSS | Notable Detail |
|---|---|---|---|
| Cisco ISE / ISE-PIC (CVE-2026-76460) | Identity & access management | 10.0 | No workaround, root-level compromise possible |
| Arista VeloCloud Orchestrator | SD-WAN orchestration | 10.0 | CISA set a 3-day federal fix window |
| SonicWall SMA1000 | Remote access appliance | 10.0 | CISA set a 3-day federal fix window |
| N-able N-central (CVE-2026-86218) | Remote monitoring & management | 10.0 | Fourth fix issued inside five weeks |
| F5 BIG-IP (CVE-2026-94127) | Application delivery controller | 9.8 | Added to CISA KEV as a zero-day |
| JetBrains TeamCity (CVE-2026-63077) | CI/CD build server | 9.8 | Later tied to ransomware exploitation |
The through-line across this list is that every one of these products is infrastructure other systems depend on and trust implicitly. A compromised VPN gateway, SD-WAN controller, or identity engine doesn’t just expose one application, it can expose everything that authenticates through it. That’s a different risk calculus than a bug in a single line-of-business app, and it explains why CISA keeps compressing its remediation deadlines for this category down to a handful of days.
Market Impact: What This Means for Enterprise Security Budgets
Every maximum-severity identity vulnerability adds weight to the argument security teams have been making to their leadership all year: perimeter and access-control infrastructure needs the same continuous scrutiny as internet-facing web applications, not periodic patching on a quarterly cycle. Organizations running ISE at scale now face an unplanned emergency-change cycle, pulling engineering hours away from other projects to reimage or upgrade appliances that, in many environments, sit at the core of network access policy for thousands of endpoints.
MeriTalk’s coverage of the federal deadline points to a broader budget question: agencies and enterprises alike now have to staff for same-day emergency patch cycles on infrastructure that used to sit on a slower maintenance calendar. That shift costs money and headcount, and it’s happening at the same time identity and access products are drawing more attacker attention than they have in years. Security leaders building 2027 budgets are increasingly treating rapid-patch readiness for network-core appliances as a line item of its own, not something absorbed inside general IT operations spend.
There’s also a vendor-risk angle. Enterprises that concentrate identity, VPN, and SD-WAN functions on a single vendor’s stack face correlated exposure when that vendor has a bad month, and Cisco has now had two severe disclosures in the same week this September. Security teams that diversify vendors reduce blast radius but multiply the number of advisories they need to track, a tradeoff that doesn’t have a clean answer and mostly gets resolved case by case depending on an organization’s risk tolerance and staffing.
Historical Context: From Perimeter Firewalls to Identity Engines
For most of the last decade, the highest-severity, most-exploited enterprise vulnerabilities clustered around perimeter firewalls and VPN concentrators, the obvious entry points attackers scan for first. What’s shifted in 2026 is how often that same severity and exploitation pattern now shows up one layer deeper, in the identity and policy systems that sit behind the firewall and decide what happens after someone gets past it. Cisco ISE, N-able N-central, and comparable platforms weren’t traditionally treated as the first line of defense, which meant they didn’t always get the same patch cadence or external red-teaming attention that internet-facing gateways did. Attackers appear to have noticed that gap before defenders fully closed it.
The VMware vCenter RCE disclosed earlier this year, which ransomware operators picked up quickly after public disclosure, follows the same script: infrastructure management software, not the applications it manages, becomes the highest-value target because compromising it grants leverage over everything downstream.
Competitive Comparison: Cisco’s Response Against Industry Norms
Judged against how other vendors have handled comparable maximum-severity disclosures this year, Cisco’s response tracks close to industry norms rather than lagging behind them. Patches for all five supported release branches shipped the same day as the advisory, which matches the pace SonicWall and Arista set for their respective CVSS-10 bugs. Where Cisco’s disclosure differs slightly is in the absence of any interim workaround, a gap SonicWall and F5 were also unable to close for their own zero-days, leaving network segmentation and access restriction as the only stopgap across the board.
What separates a well-handled disclosure from a poorly handled one at this point isn’t really the initial bug, since maximum-severity flaws now surface across the industry with some regularity. It’s the speed and clarity of the advisory, whether a workaround exists, and whether the vendor is transparent about active exploitation rather than downplaying it. On those measures, Cisco’s same-day multi-branch patch release and its PSIRT’s acknowledgment of in-the-wild exploitation put this disclosure in line with, rather than behind, how Arista and SonicWall handled their own CVSS-10 incidents earlier this year.
What Security Teams Should Do Right Now
- Identify every ISE and ISE-PIC node in the environment and confirm its current patch level against the table above.
- Apply the fixed patch for your release branch immediately, prioritizing internet-reachable or loosely segmented instances.
- Restrict access to ISE’s management and API interfaces to a dedicated administrative network if patching has to wait even a few hours.
- Review authentication and system logs for unauthenticated API requests, unexpected admin account creation, and gaps that could indicate log tampering.
- Reimage, rather than simply patch, any node where compromise is suspected, per Cisco’s own guidance.
- Treat every appliance running identity, VPN, or SD-WAN software as tier-one patching priority going forward, not a lower-tier system behind the firewall.
Predictions: Where This Goes From Here
A few things look likely to follow from this disclosure over the coming weeks and months.
- Ransomware groups will probe unpatched ISE deployments the same way they moved on the TeamCity CVE-2026-63077 flaw once it became public, since root access on identity infrastructure is exactly the kind of foothold that turns into a full network compromise.
- Cisco will likely face pressure to publish a fuller post-incident technical writeup once the forensic picture clears, given the pattern of three CVSS-10 ISE bugs in fourteen months.
- CISA’s remediation deadlines for this class of infrastructure bug will keep compressing, following the same one-to-three-day pattern set by the Arista, SonicWall, and Cisco disclosures this quarter.
- Expect more vendors to start shipping same-day, multi-branch patches as the new baseline expectation, since anything slower now reads as a lagging response by comparison.
- Enterprise security teams will keep pushing identity and access infrastructure into the same continuous-monitoring tier as internet-facing web apps, closing the attention gap that let this category of bug go under-scrutinized for years.
None of that is certain, and Cisco hasn’t confirmed a threat-actor identity or a victim count, so some of this will depend on what the forensic investigation eventually turns up. But the trajectory of 2026’s identity-infrastructure disclosures points fairly consistently in this direction, and organizations shouldn’t wait for confirmation before treating a CVSS 10.0, actively exploited, no-workaround bug in their access-control backbone as an emergency-patch event.
Frequently Asked Questions
What is CVE-2026-76460?
It’s a maximum-severity, CVSS 10.0 authentication bypass in Cisco Identity Services Engine and ISE Passive Identity Connector. An unauthenticated attacker can send a crafted request to an API endpoint, bypass the management interface’s authentication checks, and, according to reporting, reach root-level command execution on the appliance.
Is Cisco ISE CVE-2026-76460 being actively exploited?
Yes. Cisco’s Product Security Incident Response Team said it was aware of exploitation before the advisory was published on September 16, 2026, and CISA added the CVE to its Known Exploited Vulnerabilities catalog shortly after.
Which Cisco ISE versions are affected, and what’s the fix?
Release branches 3.0 through 3.5 are affected. Fixed versions are available for 3.1 (Patch 12), 3.2 (Patch 11), 3.3 (Patch 12), 3.4 (Patch 7), and 3.5 (Patch 4). The unsupported 3.0 branch has no backported fix, so those customers need to migrate to a patched release.
Is there a workaround if I can’t patch immediately?
No official workaround exists. Cisco’s interim guidance is to restrict access to the management and API interfaces to trusted administrative networks and monitor logs closely until the patch can be applied.
What can an attacker access if they exploit this flaw?
Reporting describes potential root-level command execution on the appliance, which could expose stored credentials and configuration data, allow modification of access policies, and permit creation of rogue administrative accounts.
Did CISA add this to its Known Exploited Vulnerabilities catalog?
Yes, CISA added CVE-2026-76460 to the KEV catalog around September 18, 2026, with a federal civilian remediation deadline reported as September 19, giving agencies roughly one day to remediate.
How does this compare to Cisco’s earlier ISE vulnerabilities?
Cisco ISE had two other CVSS 10.0 disclosures in June 2025, CVE-2025-20337 and CVE-2025-20338. Available reporting doesn’t confirm they share a root cause with CVE-2026-76460, but it marks the third maximum-severity ISE finding in roughly fourteen months.
What should security teams do right now?
Patch every ISE and ISE-PIC node to the fixed version for its release branch, restrict management-interface access where patching isn’t immediately possible, review logs for signs of exploitation, and reimage any node where compromise is suspected rather than relying on an in-place upgrade alone.
