Cisco Patches Maximum-Severity ISE Zero-Day Already Exploited in Attacks

Cisco released emergency fixes on September 16 for CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector. An API endpoint lacks sufficient authentication controls, so a remote attacker can send crafted requests, skip the web management interface and gain root-level command execution.

Cisco's security team confirmed the flaw was being exploited as a zero-day before the patch shipped. It affects every configuration and has no workaround. Fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies days, not weeks, to patch.

ISE sits at the center of network access control, so root access lets attackers change policies, steal credentials and move laterally. It is the second critical Cisco zero-day of the week, after a root RCE flaw in Secure Email Gateway.