Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access

Cisco has disclosed and patched CVE-2026-76460, a maximum-severity authentication bypass affecting an API endpoint in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products. The flaw, rated 10 out of 10 on the CVSS scale, results from insufficient authentication controls. Cisco says an attacker can send a specially crafted request to gain unauthorised access through the web-based management interface.

Successful exploitation requires no authentication or user interaction and can provide root privileges and command execution. The vulnerability was disclosed on 16 September 2026, and the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalogue that day, confirming exploitation, although the attackers and scale of activity remain unclear.

The risk is wider than compromise of an individual appliance because ISE provides authentication and access-control decisions for other Cisco APIs and network resources. SANS Internet Storm Center founder Johannes Ullrich said an attacker could disable ISE, impersonate hosts or influence access decisions, potentially enabling further compromises. Cisco also disclosed several other ISE and ISE-PIC vulnerabilities involving similar API authentication problems.

CVE-2026-76460 affects the products regardless of configuration. Cisco has issued fixes for versions 3.1 through 3.5 and said version 3.0 is unsupported, advising customers to upgrade. Infrastructure access control lists can restrict management and control-plane traffic and prevent remote exploitation, but Cisco described this as temporary mitigation.

Administrators should also review external network and firewall logs for suspicious uploads from affected devices or downloads from malicious IP addresses, since attackers with root access may delete or conceal evidence.