Cisco Identity Services Engine, the network-access-control appliance that decides which devices and users get onto the network, has a maximum-severity authentication bypass that attackers were already exploiting before Cisco knew it existed. CVE-2026-76460 carries a CVSS score of 10.0 and affects both Cisco ISE and ISE Passive Identity Connector (ISE-PIC).

What happened

ISE’s web-based management interface is supposed to be the front door: log in, get authenticated, then reach the administrative functions behind it. CVE-2026-76460 breaks that model by attacking the layer underneath it. The product exposes an API endpoint that fails to verify whether an incoming request actually originates from an authenticated, authorized session. An attacker who sends a crafted request straight to that API doesn’t need to pass through the management interface’s login at all — the request lands with privileged access regardless.

The practical effect is that the authentication boundary most administrators assume protects ISE’s management plane can be walked around entirely by talking to the API directly. Cisco rates the resulting access as command execution with root privileges on the underlying appliance OS, and the bug applies “regardless of device configuration” — there’s no optional feature or non-default setting that has to be enabled first.

What makes this one unusual is how Cisco found it: not through a bug bounty submission or internal audit, but while working a Cisco TAC support case for a customer who had already been compromised. By the time the root cause was identified and reported, at least one production ISE deployment was already in an attacker’s hands. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, one day before this post, confirming exploitation is not isolated to that single incident.

Affected versions and fix

  • Cisco Identity Services Engine (ISE): releases 3.0 through 3.5
  • Cisco ISE Passive Identity Connector (ISE-PIC): same release range

Cisco has not published a workaround — there is no configuration change, ACL, or feature toggle that mitigates this short of patching. Fixed releases:

  • ISE 3.1 — Patch 12
  • ISE 3.2 — Patch 11
  • ISE 3.3 — Patch 12
  • ISE 3.4 — Patch 7
  • ISE 3.5 — Patch 4

Any ISE or ISE-PIC deployment on 3.0–3.5 that hasn’t applied the above patch level is exposed.

Impact

ISE isn’t a peripheral service — it’s the policy decision point for network admission control, 802.1X authentication, device posture, and segmentation across enterprise and campus networks. Root on the ISE appliance means an attacker inherits the trust the network places in it: they can read or manipulate the authentication and authorization policies that determine what every other device on the network is allowed to do, pull stored credentials and certificates used for network access, and pivot from a position that most security architectures treat as inherently trusted infrastructure rather than an endpoint to be defended.

Because exploitation requires no credentials, no user interaction, and works identically across configurations, any internet-reachable or otherwise network-accessible ISE management interface on an affected release should be treated as potentially already compromised, not just theoretically vulnerable — Cisco’s own discovery path proves that assumption isn’t paranoid.

Mitigation

  • Patch now to the fixed release for your branch (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4). There is no workaround; patching is the only fix.
  • Assume compromise until proven otherwise on any unpatched instance. Review ISE administrative audit logs for API calls and configuration changes that don’t correlate with legitimate admin sessions, and check for new local accounts, altered authorization policies, or unexpected certificate/credential access.
  • Restrict network reachability to ISE’s administrative interfaces and APIs to trusted management networks — this doesn’t fix the bug but shrinks the population of hosts that can reach the vulnerable endpoint while patching is staged.
  • Rotate credentials and certificates stored in or managed by ISE if you find any indicator of prior access, since a compromised NAC platform can expose the keys used to authenticate other devices.
  • Prioritize this over routine patch cycles. CVSS 10.0, pre-disclosure exploitation, KEV listing, and a CISA federal remediation deadline are the profile of a vulnerability that keeps getting used against unpatched targets long after the news cycle moves on.

Cisco’s advisory is published on its Security Advisories portal under the ISE privileged-API-bypass bulletin; check it directly for the authoritative patch matrix for your specific release train.