Cisco Discloses Maximum Severity ISE Zero Day Under Active Exploitation

Cisco has disclosed a maximum-severity security vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that is under active exploitation in the wild. The flaw, tracked as CVE-2026-76460, carries a CVSS 3.1 base score of 10.0, the highest possible rating, and allows an unauthenticated, remote attacker to bypass authentication on the web-based management interface. Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on September 16, 2026, at 16:00 GMT, and confirmed that threat actors are already using the flaw. The advisory is part of a larger set of security advisories released by the vendor that day.

Cisco ISE is an identity-based network access control and policy platform. It checks the identity of connecting users, profiles devices, checks their security posture, grants the right type of access, and logs all activity. IT administrators use it to manage endpoints, users, and device access to network resources, often while enforcing Zero Trust security models. Because ISE sits at a critical control point in the network, a successful bypass can undermine an organization's entire access control framework.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) Catalog on September 16, 2026, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the flaw by September 19, 2026. That three-day deadline reflects the severity of the vulnerability and the evidence of active exploitation. CISA also added a second vulnerability, CVE-2026-87886, an Acronis Backup flaw, to the KEV catalog on the same day.

The disclosure is part of a wave of 77 new CVEs issued on Wednesday, September 16, 2026. Of those, 41 affect ISE and 28 affect the Secure Firewall portfolio. Other ISE flaws include CVE-2026-76423, which also has a CVSS score of 10.0, and CVE-2026-20176, which scores 9.9. The sheer volume of vulnerabilities underscores the scale of the security challenge facing Cisco and its customers.

Key Facts

Cisco Security Advisory reported on September 16 that the vulnerability is due to insufficient authentication control on an API endpoint, a weakness classified as CWE-648, Incorrect Use of Privileged APIs. The Cisco Bug ID is CSCww39530. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which indicates a network attack vector, low attack complexity, no privileges required, no user interaction, a scope change, and high impact on confidentiality, integrity, and availability.

The vulnerability affects Cisco ISE and ISE-PIC releases 3.0 through 3.5 regardless of device configuration. Fixed software releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. There are no workarounds. Cisco recommends using infrastructure access control lists (iACLs) as a mitigation to allow only required management and control-plane traffic destined for the affected device, but iACLs do not fix the underlying flaw.

Upon successful exploitation, threat actors may obtain command execution with root privileges, according to Cisco. Because of this level of access, evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors. Cisco advises reviewing the access.log file on every node in the deployment and looking for suspicious usernames. The vendor provides the command 'admin#show logging application ise-kong/access.log | include dummyuser' as an example. If malicious activity is suspected, Cisco strongly recommends re-imaging the affected nodes and restoring from a configuration backup. Defenders should also cross-check network and firewall logs outside the device for unexpected uploads to external IP addresses or downloads from malicious IPs.

CISA reported on September 16 that it added CVE-2026-76460 and CVE-2026-87886 to the KEV catalog based on evidence of active exploitation. CISA states that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04, Prioritizing Security Updates Based on Risk, establishes vulnerability management requirements for FCEB agencies and requires rapid remediation of high-risk vulnerabilities listed in the KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation. The KEV entry for CVE-2026-76460 has a date added of 2026-09-16 and a remediation due date of 2026-09-19.

The Hacker News reported on September 17 that Cisco said it is aware of active exploitation but did not disclose the nature of the attacks or the identity of the attackers. The disclosure came days after Cisco said CVE-2026-76461, a CVSS 9.8 flaw in Cisco Secure Email Gateway, was being exploited. Among the 77 new CVEs, the 41 ISE vulnerabilities include CVE-2026-76423 (CVSS 10.0) and CVE-2026-20176 (CVSS 9.9), though those have not been flagged as exploited.

Analysis

What this really means is that identity and access management systems have become a top target for attackers, and a maximum-severity authentication bypass in a platform like Cisco ISE is a nightmare scenario. The flaw requires no authentication, no user interaction, and can be exploited remotely over the network with low complexity. It affects all configurations, and there are no workarounds. The only fix is to patch, which puts enormous pressure on organizations to act quickly.

The potential for root-level command execution is particularly alarming because it allows attackers to cover their tracks. BleepingComputer reported on September 17 that attackers may remove evidence after obtaining root privileges, so defenders cannot rely solely on device logs. They must cross-check network and firewall logs for unexpected uploads to external IP addresses or downloads from malicious IPs. If an organization suspects exploitation, re-imaging nodes and restoring from backup is strongly recommended, but that is a disruptive and costly process. The fact that evidence may be hidden means that many organizations may not even know they were compromised until it is too late.

The broader wave of 77 CVEs, with 41 affecting ISE, suggests that Cisco's ISE codebase is under intense scrutiny. Some of these vulnerabilities were found during internal security testing with the help of frontier AI models, according to Help Net Security on September 17. That highlights both the promise and the risk of AI-assisted vulnerability discovery: it can find flaws faster, but it also means attackers may leverage similar techniques. The involvement of AI in security testing is a double-edged sword.

The bigger picture here is that vulnerability management is shifting from a cyclical, monthly patch process to a continuous, risk-based emergency response. CISA's KEV catalog is a powerful tool, and BOD 26-04 gives it teeth. However, the reality is that many federal agencies struggle to patch within such a short window, especially for complex systems like ISE that may require re-imaging and configuration restoration. The three-day deadline for CVE-2026-76460 is one of the shortest remediation windows in recent memory.

Why It Matters

Cisco ISE is widely deployed across government, healthcare, finance, and education. A compromise can give attackers a foothold to move laterally, escalate privileges, and access sensitive data. Because ISE is used for network access control, an attacker who bypasses authentication can potentially grant themselves access to segmented networks, undermining Zero Trust architectures. The flaw affects ISE and ISE-PIC regardless of configuration, which means every deployment is potentially vulnerable until patched.

The history of Cisco ISE exploitation is not reassuring. BleepingComputer reported on September 17 that in July 2025, threat actors exploited Cisco ISE zero-day CVE-2025-20337, a maximum severity remote code execution flaw, to deploy a custom 'IdentityAuditAction' web shell disguised as a legitimate ISE component. Over five years, CISA has tagged 99 Cisco flaws as actively exploited, including seven abused in ransomware attacks. This pattern shows that Cisco products are a favorite target for both espionage and financially motivated actors. The new vulnerability fits that pattern: it is remotely exploitable, grants root access, and affects a core identity system.

For federal agencies, the September 19 deadline is a hard stop. But private sector organizations should not ignore the warning. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV catalog vulnerabilities. The incident also reinforces the need for better detection and response capabilities around identity infrastructure, because once attackers gain root on an ISE node, they can hide their tracks and persist for long periods.

Next Up

Cisco customers should immediately upgrade to the fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Those on unsupported ISE 3.0 should migrate to a supported release, as 3.1 and 3.2 only receive critical fixes. After patching, security teams should review access.log files on every node for suspicious usernames and cross-check network and firewall logs for anomalous activity. If malicious activity is suspected, re-imaging affected nodes and restoring from configuration backup is strongly recommended.

Expect further scrutiny of Cisco's ISE and Secure Firewall portfolios as researchers dig into the remaining 76 CVEs from the September 16 advisory group. CISA may add more Cisco flaws to the KEV catalog if exploitation is confirmed. The incident also puts a spotlight on the security of identity infrastructure and the role of AI in vulnerability discovery.