Cisco has released a security update to address a critical zero day vulnerability in its Identity Services Engine (ISE), following reports that attackers are already exploiting the flaw in the wild.
Tracked as CVE 2026 76460, the vulnerability carries a maximum severity rating of 10 out of 10. It could allow an unauthenticated remote attacker to bypass authentication controls and gain unauthorized access to an affected Cisco ISE device.
The issue is particularly concerning for organizations that rely on Cisco ISE to manage network access, enforce identity based security policies and control which users and devices can connect to corporate infrastructure.
Cisco has confirmed that its Product Security Incident Response Team (PSIRT) is aware of active exploitation. The company is urging customers to install the relevant software updates as soon as possible.
There is no workaround available for this vulnerability. According to Cisco, upgrading to a fixed software release is the only way to address the security issue.
How the Cisco ISE Vulnerability Works
Cisco Identity Services Engine is a network access control and identity management platform used by businesses to determine who or what can connect to their networks and which resources they can access.
The platform plays an important role in enforcing access policies across enterprise environments. A vulnerability affecting its authentication mechanisms could therefore create serious security concerns for organizations using the product.
According to Cisco’s security advisory, CVE 2026 76460 stems from insufficient authentication controls on an API endpoint.
An attacker does not need to authenticate before attempting to exploit the flaw. By sending a specially crafted request to an affected API endpoint, a remote attacker could bypass authentication and gain unauthorized access to the device.
The vulnerability affects Cisco Identity Services Engine and Cisco ISE Passive Identity Connector (ISE PIC). Cisco states that the issue affects these products regardless of their configuration.
That broad exposure makes it important for administrators to identify affected deployments rather than assuming that particular configuration settings will protect them.
Although the vulnerability has been assigned a critical severity score, the precise consequences of a successful attack will depend on the affected environment and what access the attacker obtains.
Active Exploitation Raises the Urgency for Administrators
The vulnerability is not simply a theoretical security concern. Cisco has confirmed that its security team is aware of attacks exploiting the flaw.
The US Cybersecurity and Infrastructure Security Agency (CISA) has also added CVE 2026 76460 to its Known Exploited Vulnerabilities (KEV) catalog.
The catalog identifies vulnerabilities that have been exploited in real world attacks and helps organizations prioritize remediation efforts.
For US federal agencies, CISA has set a September 19, 2026 deadline to address the vulnerability. Agencies must apply the required security update or discontinue use of the affected product in accordance with the directive.
The deadline highlights the urgency of the issue, particularly for organizations operating Cisco ISE as part of their network security infrastructure.
Private sector organizations are also being urged to take action promptly. While the federal deadline does not automatically apply to every business, the confirmed exploitation means administrators should not treat the update as routine maintenance that can be postponed indefinitely.
Organizations should review their Cisco ISE deployments, identify affected software versions and follow Cisco’s official security guidance to determine which fixed release they need.
No Workaround Available, Cisco Recommends Immediate Patching
Cisco has confirmed that there are no workarounds for CVE 2026 76460.
This means organizations cannot rely on a temporary configuration adjustment as a substitute for installing the security update. Applying the appropriate fixed software release is the recommended mitigation.
Administrators should consult Cisco’s security advisory to check the affected versions and identify the corresponding software updates.
Before beginning the upgrade, organizations should follow their normal change management procedures, including reviewing compatibility requirements, preparing backups and planning for any operational disruption.
However, the presence of active exploitation means that delaying remediation can leave affected systems exposed for longer than necessary.
Security teams should prioritize internet accessible or otherwise exposed management infrastructure, while also reviewing internal deployments that could be reachable by an attacker who has already gained access to a corporate network.
Patching should be treated as part of a broader incident response process, especially if there are indications that an affected device may already have been compromised.
Cisco Advises Organizations to Check for Signs of Compromise
Installing the security update is an essential step, but organizations should also investigate whether attackers have already accessed their systems.
Cisco has shared indicators of compromise (IoCs) and recommended that defenders look for suspicious usernames in access.log files across every node.
Reviewing logs across the deployment can help security teams identify unusual activity that might otherwise be missed when examining only a single device.
Administrators should investigate unfamiliar accounts, unexpected access patterns and other activity that does not align with normal administrative operations.
If a compromise is suspected or confirmed, Cisco has recommended reimaging affected nodes and restoring them from backups.
These recovery measures are intended to help organizations return affected systems to a trusted state. Before restoring services, security teams should investigate the incident, assess the integrity of their backups and determine whether additional systems or credentials may have been affected.
Simply installing a patch does not necessarily remove an attacker who has already established unauthorized access.
Organizations should therefore coordinate vulnerability remediation with their incident response teams and continue monitoring for suspicious activity after applying the update.
Four Key Points to Know
- Critical security flaw: CVE 2026 76460 carries a 10 out of 10 severity rating and could allow unauthenticated remote attackers to bypass authentication.
- Active exploitation confirmed: Cisco PSIRT is aware of attacks, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
- Patching is the only mitigation: No workaround is available. Administrators should identify affected Cisco ISE and ISE PIC versions and install the corresponding fixed releases.
- Investigate possible breaches: Cisco recommends checking access.log files on every node for suspicious usernames. Compromised nodes may need to be reimaged and restored from backups.
What Organizations Should Do Next
For businesses using Cisco Identity Services Engine, the immediate priority is to establish whether their deployment is affected and apply the appropriate security update.
Security teams should also review Cisco’s indicators of compromise, inspect relevant logs and investigate suspicious activity. Where evidence of unauthorized access exists, organizations should move beyond patching and follow a comprehensive recovery process.
CVE 2026 76460 is a reminder that vulnerabilities in identity and network access infrastructure can have implications beyond a single application. These systems help determine who can enter an organization’s network, making their security particularly important.
With active exploitation confirmed and no workaround available, organizations should prioritize remediation and verify that their affected deployments have been brought up to date.
Follow TechBSB For More Updates
