Cisco Patches Zero Day Letting Attackers Take Root Access in ISE

Cisco has released urgent patches for a critical authentication-bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), after confirming that it is being exploited in the wild as a zero-day. Tracked as CVE-2026-76460 and rated 10/10 on CVSS, the flaw affects an API endpoint that does not apply sufficient authentication controls. Attackers can send crafted requests to bypass the web-based management interface and access affected appliances. Cisco says all configurations are affected and has not identified those behind the attacks.

Customers should upgrade to ISE or ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11 or 3.1 Patch 12. There is no software workaround, although infrastructure access control lists can restrict traffic to the affected device and prevent remote exploitation. Cisco warns that successful exploitation can allow command execution with root privileges, potentially enabling attackers to hide or delete indicators of compromise.

Organisations should inspect `access.log` on every node for suspicious usernames, including across distributed deployments. If malicious activity is suspected, Cisco recommends re-imaging affected nodes and restoring them from configuration backups where necessary. Administrators should also review external network and firewall logs for unexpected uploads or downloads.

On Wednesday, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-76460 to its Known Exploited Vulnerabilities catalogue, directing federal agencies to patch within three days under BOD 26-04.