Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

What it is

CVE-2026-76460 (CVSS 10.0), an unauthenticated auth bypass in Cisco ISE and ISE-PIC caused by insufficient authentication control on an API endpoint. An attacker sends a crafted request to the affected endpoint and gains access by bypassing the web-based management interface; successful exploitation yields command execution with root privileges. The flaw affects ISE/ISE-PIC regardless of device configuration, is under active exploitation, and was added to CISA KEV on September 16, 2026 with an FCEB patch deadline of September 19, 2026.

What to do

Upgrade to a fixed release — the boundaries the summary omits:

• 3.1 → Patch 12
• 3.2 → Patch 11
• 3.3 → Patch 12
• 3.4 → Patch 7
• 3.5 → Patch 4

There is no workaround. As mitigation, restrict management/control-plane traffic to the device with infrastructure ACLs (iACLs).

Detection — review access.log for suspicious usernames on every node in a distributed deployment. Cisco's command:

admin#show logging application ise-kong/access.log | include dummyuser

Any entry in the output likely indicates malicious activity. If detected, re-image the affected nodes and restore from configuration backup.

Caveats

Cisco states that because exploitation grants root, "evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors" — so a clean access.log grep is not proof of safety, and the re-image-from-backup path exists precisely because logs may be untrustworthy. Cisco disclosed nothing about the attacks or the actor behind them.