Cisco's Identity Services Engine got a maximum-severity patch this week, and it did not go quietly: active exploitation was confirmed before the advisory even finished circulating.
CVE-2026-76460 is an authentication bypass in the ISE web-based management API. The mechanism is blunt. A remote unauthenticated attacker sends a specially crafted request to an API endpoint on the ISE appliance. The endpoint does not enforce authentication checks on this path. The attacker bypasses the management interface without credentials, without a session, and without social engineering anyone.
What happens after the bypass
Successful exploitation does not land the attacker in a read-only interface. It gives root-level command execution on the ISE host. That access level allows the attacker to alter system configuration, modify policy, and, critically, remove or conceal evidence of compromise. The forensic-concealment capability makes post-incident investigation substantially harder than a standard RCE where logs are intact.
Cisco's advisory notes that root access on ISE means control over which devices are permitted onto the network, which certificates are trusted, and which users have posture compliance. ISE is the gatekeeper: compromising it is not a foothold, it is a lateral movement accelerator.
The scope is broad
CVE-2026-76460 affects both Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC). It does not require a specific configuration to be enabled. The vulnerability is in the base product.
Affected versions and their patch targets:
- ISE 3.5: apply Patch 4
- ISE 3.4: apply Patch 7
- ISE 3.3: apply Patch 12
- ISE 3.2: apply Patch 11
- ISE 3.1: apply Patch 12
There are no known workarounds that eliminate the risk. Cisco's recommendation is to patch.
CISA's timeline and why it matters
CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog on September 16, 2026. Federal Civilian Executive Branch agencies have until September 19 to apply patches, a compressed three-day window that reflects the severity and confirmed exploitation. Non-federal organizations are not bound by this deadline but should treat it as an indicator of urgency calibration: if the government thinks this is a three-day problem, it probably is.
For reference, most CISA KEV additions carry a two- to three-week remediation window. A three-day deadline is reserved for actively exploited vulnerabilities where the risk of not patching outweighs patching disruption.
A pattern worth noting
This is the second actively exploited Cisco zero-day in the KEV catalog this week. CVE-2026-76461, a CVSS 9.8 SQL injection in Cisco Secure Email Gateway that achieves root RCE via a crafted inbound email, was added to KEV earlier with a September 17 FCEB deadline. Two critical exploited flaws in one product family in one week is not a coincidence. It is a signal that Cisco's security posture is under focused attention from threat actors and researchers alike, and that organizations running Cisco infrastructure should treat this period as heightened-risk.
What to do
Check your ISE version against the patch matrix above. If you are running an affected version, patch this weekend. If you cannot patch immediately, restrict management interface access to a dedicated, monitored management VLAN with strict source IP controls. This does not eliminate the risk but reduces the attack surface while you schedule the upgrade.
Review ISE logs for unauthorized API activity, particularly crafted requests to management endpoints, and look for account creation, policy modification, or posture bypass events that occurred without an associated administrator session.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization needs help triaging critical Cisco infrastructure vulnerabilities or building a defensible patch prioritization process.