Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access

Cisco warned on 16 September 2026 that attackers are actively exploiting a critical vulnerability in its Identity Services Engine (ISE) and ISE-PIC products. Tracked as CVE-2026-76460, the flaw has a CVSS score of 10.0 and affects releases 3.1 through 3.5 across all device configurations. Cisco says its PSIRT is aware of exploitation in the wild.

The vulnerability results from insufficient authentication controls on an API endpoint. According to the supplied report, an unauthenticated remote attacker can send crafted network requests that bypass the web management interface, execute commands with root privileges and potentially erase log entries. Cisco reportedly discovered the issue while handling a Technical Assistance Center support case.

Because ISE enforces network access policies, a compromised deployment could provide access to internal resources and allow attackers to alter access rules or move further into corporate networks.

Cisco has issued fixes in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. The report says there is no temporary workaround, although administrators can use infrastructure access control lists to block untrusted traffic. Cisco ISE operators should apply the relevant update immediately and review access logs for suspicious entries involving the “dummyuser” account.