Cisco's Identity Engine Decides Who Gets On the Network. One Unauthenticated Request Skips the Question

Cisco published an emergency advisory on 16 September for a defect in Identity Services Engine, the appliance most large enterprises use to decide which users and devices are allowed onto their network. CVE-2026-76460 carries a CVSS base score of 10.0 — the ceiling — and Cisco's product security team says it is already being used in attacks. There is no workaround. CISA added it to the Known Exploited Vulnerabilities catalog the same day and set a remediation deadline of 19 September for federal civilian agencies, a three-day window that is about as compressed as that mechanism gets.

This is the second Cisco appliance in a week to move from advisory to active exploitation, after the Secure Email Gateway flaw published two days earlier. The pattern is worth naming. The products being hit are not obscure corners of the catalogue. They are the boxes that sit at the network's front door and, by design, accept traffic from strangers.

What the flaw is

Cisco describes the defect as insufficient authentication control on an API endpoint. In the company's words:

An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Two details matter to defenders. The first is that no credentials and no prior foothold are required — the attacker does not need to be anyone in particular, and the device is vulnerable regardless of how it is configured. The second is that Cisco says successful exploitation can lead to command execution with root privileges. That is the whole appliance, not a corner of it.

Cisco's statement on exploitation is unambiguous:

The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

Who is affected

ISE and the ISE Passive Identity Connector (ISE-PIC) are vulnerable across the supported line. There is no safe branch to sit on.

The fix shipped inside a September hardening release for ISE, which Cisco says came out of an internal security review of the product rather than an outside report. The Hacker News counted 76 vulnerabilities disclosed across the same window, 41 of them in ISE and 28 in Secure Firewall products, including a second flaw also rated 10.0. Only CVE-2026-76460 is known to be exploited.

Why root on this box is worse than root on most boxes

ISE is not a server that happens to hold sensitive data. It is the policy decision point: the thing that answers, thousands of times a minute, whether a laptop joins the corporate network, whether a contractor's phone lands on the guest VLAN, whether an administrator gets a shell on a switch. To do that job it holds directory integration accounts, RADIUS and TACACS+ shared secrets, certificates, and the authorisation policy itself.

An attacker with root on ISE therefore does not merely own one machine. They own the rules that decide what everyone else is allowed to reach — and they can write themselves a rule that every downstream device will honour without complaint. Traffic that follows a policy ISE issued does not look like an intrusion. It looks like the network working.

The second-order problem is evidentiary. Cisco warned that root access would let an attacker hide or delete indicators of compromise, and ISE is frequently the system that records who authenticated to what. Compromising it damages the log trail you would use to scope the compromise. Patching closes the door; it does not tell you whether somebody already walked through it.

Three days is the tell

CISA's standard remediation window under the KEV catalogue is measured in weeks. Three days is what the agency reaches for when it judges the installed base to be large and the exploitation to be real rather than predicted. Nothing in the public record says how many organisations have been hit, and Cisco has not said who found the activity. But the deadline is a statement about confidence, and it was set the same day the advisory went out.

What to do now

Patch to the fixed release for your branch. No configuration change substitutes for it, and the usual mitigation of restricting the management interface does not close this one.

Treat any ISE deployment that was reachable before patching as suspect rather than clean. Review administrative access logs, as Cisco advises, and compare them against a copy held off the appliance — root would have let an attacker edit what is stored on it. Rotate what the box holds: shared secrets, directory service accounts, administrative credentials, certificates.

Then take the management plane off any network that does not need to see it. That will not fix CVE-2026-76460. It shortens the list of people who can reach the next one.

Sources: Cisco Security Advisory: Cisco Identity Services Engine Hardening Release: September 2026 · BleepingComputer: Cisco warns of max severity ISE zero-day exploited in attacks · The Hacker News: Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks · SecurityWeek: Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day · CISA: Known Exploited Vulnerabilities Catalog