Why CVE-2026-76460 in Cisco ISE Deserves Immediate Patching
A CVSS score of 10.0 is rare, and it usually signals a flaw that removes an entire layer of defense. CVE-2026-76460 does exactly that for Cisco Identity Services Engine: it allows unauthenticated remote code execution with root privileges, and Cisco has confirmed that attackers are already using it.
Vulnerability overview
The flaw is an authentication bypass in Cisco ISE and ISE-PIC, disclosed on September 16, 2026. Cisco's PSIRT rated it CVSS 10.0 and reported active exploitation. The company found the issue while handling a support case, not during routine internal testing.
Mechanism and exploitation conditions
The root cause is "insufficient authentication control on an API endpoint," according to Cisco. In practice, an attacker crafts network requests aimed at that endpoint. The endpoint fails to enforce authentication properly, so the request proceeds without valid credentials and bypasses the web management interface. The attacker then runs commands as root.
Two conditions matter for defenders assessing risk. First, the endpoint must be network-reachable. Second, no authentication is needed, so the attacker does not need a foothold, a credential, or a session. The advisory adds that an intruder can delete log entries, which means the absence of evidence in logs is not evidence of absence.
Impact
Root access to an ISE appliance is a serious outcome. ISE governs network admission and identity policy, so control of the server lets an attacker rewrite access rules and move laterally into private corporate subnets. The platform's role as a policy authority means its compromise can weaken controls that other parts of the environment depend on.
Affected products and scope
Cisco ISE and Cisco ISE-PIC are affected in all device configurations, across releases 3.1 through 3.5. Cisco did not publish a temporary workaround.
Exposure context
ZoomEye reports 4,051 instances matching app="Cisco ISE". Querying the CVE directly with vul.cve="CVE-2026-76460" returned 0 results, a common outcome for a newly published CVE that has not yet been mapped in the index. The fingerprint count shows how much Cisco ISE surface is observable on the internet; it is not a vulnerability confirmation for each host.
Remediation and mitigations
Cisco shipped fixes in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Patch to the release that matches your deployment. With exploitation confirmed, treat this as urgent rather than routine.
Because no workaround exists, use network controls as a stopgap. Restrict which sources can reach ISE management interfaces with infrastructure ACLs, and hunt for dummyuser account entries in access logs as a possible sign of intrusion.
References
- SecurityOnline.info report on CVE-2026-76460: https://securityonline.info/cisco-ise-vulnerability-exploited/
- CISA KEV catalog addition: https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
