Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco disclosed a maximum-severity zero-day vulnerability in Identity Services Engine (ISE) that attackers actively exploit in the wild. The flaw, designated CVE-2026-76460, carries a CVSS score of 10.0, meaning it presents near-universal risk across networked deployments.

The vulnerability stems from insufficient authentication controls on an API endpoint within ISE. An unauthenticated, remote attacker can bypass authentication mechanisms entirely without requiring valid credentials, user interaction, or network proximity restrictions. This creates a direct path to system compromise for any organisation running vulnerable ISE instances exposed to the internet or accessible from attacker-controlled networks.

Identity Services Engine functions as a network access control and policy enforcement platform. It manages authentication, authorisation, and accounting for enterprise networks, guest access, and BYOD deployments. When ISE authentication fails, attackers gain control over network access decisions, potentially granting themselves unrestricted network privileges, lateral movement capabilities, and access to sensitive resources spanning employee devices, IoT systems, and infrastructure.

Cisco's statement confirms active exploitation. This means threat actors have already weaponised CVE-2026-76460 and deployed attacks against live targets. Organisations running ISE should treat this as an immediate, not future, threat.

The API endpoint vulnerability allows bypass without any special tools or advanced techniques. Remote attackers can craft standard HTTP requests to the affected endpoint to circumvent authentication gates entirely. This distinguishes the flaw from more complex vulnerabilities requiring detailed exploitation chains or race conditions. Any exposed ISE instance becomes compromised rapidly.

ISE deployments vary widely in scope. Some organisations run single appliances; others operate distributed clusters across multiple sites. Large enterprises often integrate ISE with corporate identity management systems, directory services, and wireless infrastructure. A successful attack exposes not just ISE but potentially the entire authentication backbone supporting network access control.

The vulnerability affects administrators and security teams most directly. ISE breach notifications often arrive days after compromise occurs because attackers maintain stealth during reconnaissance phases. Authentication bypass means logs may not accurately reflect intrusions. Attackers can modify policies, grant themselves administrator accounts, disable security controls, and establish persistent access mechanisms before detection occurs.

Cisco has not yet released patched versions publicly. The advisory indicated that patches would arrive, but the timeline remains unclear. Organisations cannot rely on vendor updates arriving before attacks intensify. Immediate mitigation steps include restricting API endpoint access using network-level controls, firewall rules, and rate limiting. Disabling unnecessary API features reduces exposure surface. Implementing continuous monitoring for unusual authentication patterns and API requests can surface exploitation attempts.

ISE instances should receive immediate network segmentation. Isolating ISE from untrusted networks, requiring VPN for remote access, and implementing strict ingress filtering reduce attacker reach. Network monitoring should flag any non-standard API requests, authentication bypass attempts, and policy modifications.

Large enterprises managing hundreds of ISE appliances face deployment complexity during mitigation. Cloud-hosted ISE instances present additional challenges because organisations cannot restrict network access as easily as on-premises deployments. Hybrid environments require careful coordination between cloud providers and internal teams.

The zero-day status and active exploitation create urgency that exceeds normal patching cycles. Risk assessment should prioritise ISE systems handling sensitive network access decisions, guest networks, and contractor access. High-risk deployments deserve immediate protective measures pending official patches.