Cisco ISE auth bypass, exploited in wild (CVE-2026-76460)

Actively exploited in the wild - CVE-2026-76460 is a critical authentication bypass in the Cisco Identity Services Engine (ISE) API that grants unauthenticated, remote attackers full administrative access to the web management interface. Cisco has confirmed exploitation; apply the vendor patch immediately.

Overview

Cisco Identity Services Engine is the policy decision point for enterprise network access control. It decides which devices and users are allowed onto wired, wireless, and VPN infrastructure, which makes it a high-value target: compromise ISE and you can authorize anything.

CVE-2026-76460 stems from insufficient authentication control on an API endpoint. The REST API is meant to require authentication before processing requests, but one endpoint fails to enforce that check. An attacker who can reach the ISE management interface over the network can send a crafted request that skips the login step entirely. No credentials, no user interaction, and no special network position are needed. CVSS scores it 10.0, the maximum.

Impact

A successful exploit lets the attacker reach the web-based management interface without authenticating, effectively becoming an administrator. From there they can:

• Read and modify authentication and authorization policies
• Access or export sensitive data, including user and device records
• Change administrative credentials and lock out legitimate admins
• Pivot to other integrated Cisco and identity systems

Because ISE often integrates with Active Directory and RADIUS/TACACS, a compromised ISE can become a stepping stone into the broader enterprise. This aligns with a pattern seen across Cisco products: Secure Email Gateway and FMC were both targeted in the wild, and FMC saw a dedicated zero-day (CVE-2026-20316). Network management planes are clearly a priority for attackers.

Remediation

1. Identify every ISE deployment (physical, virtual, and cloud) and confirm whether it is internet-facing or reachable from untrusted segments.
2. Apply the Cisco security advisory patch for CVE-2026-76460 as the primary fix. Schedule it urgently; KEV status means this is not a routine maintenance window.
3. If you cannot patch immediately, restrict management interface access to trusted admin networks and disable the affected API endpoint if Cisco provides that option in the advisory.
4. Review ISE logs for unexpected API requests, new admin accounts, or policy changes that predate the patch, and rotate administrative credentials and any integrated secrets.
5. Check whether lateral movement occurred into AD or downstream systems.

Security Insight

CVE-2026-76460 is a reminder that the systems which decide trust are the ones attackers most want to control. Cisco has now produced a run of actively exploited management-plane bugs, and this one scores a perfect 10.0. Organizations that treat ISE as “just infrastructure” rather than a crown-jewel asset are the ones most exposed. If an identity broker like this falls, so does the access control story it was supposed to enforce.

Further Reading

• Cisco Secure Email Gateway zero-day actively exploited
• Cisco FMC bugs exploited to deploy Qilin ransomware
• Cisco FMC zero-day CVE-2026-20316 exploited in wild
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs