What happened

Cisco disclosed CVE-2026-76460 on September 16, 2026, an unauthenticated authentication bypass in Identity Services Engine (ISE), the appliance most large enterprises use to decide who and what is allowed onto their network. The flaw scores a CVSS 10.0, the maximum the scale allows (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and Cisco's PSIRT says it is already being exploited in the wild. In its security advisory, Cisco states plainly that "there are no workarounds that address this vulnerability."

The root cause is insufficient authentication control on an API endpoint. A remote attacker with no credentials sends a crafted request to that endpoint and walks straight past the web-based management interface. There is no phishing step, no stolen password, no user interaction. Reachability of the management interface is the whole attack.

Why it matters

ISE is not an ordinary application. It is the thing that enforces network access policy: which laptops join which VLAN, which contractor gets guest-only Wi-Fi, which server segment a compromised host can reach. Root on that box is root on the rulebook. Cisco's advisory describes the downstream reach directly: an attacker who chains this to command execution can modify access policy, extract stored credentials, delete logs and pivot into every segment ISE governs, then remove the indicators of compromise on the way out.

That is the difference between this and a bug in a single web app. A breached ISE does not leak one system, it re-writes the trust boundaries of the network it sits in front of. For anyone running it, the practical read is short: patch now, or take the management plane off the reachable network until you can.

Who is affected, and the fix

The advisory lists Cisco ISE and the ISE Passive Identity Connector (ISE-PIC), in all device configurations, across releases 3.1 through 3.5. There is no unaffected supported branch in that range; the fix is a patch, not an upgrade to a safe version you may already run.

Cisco's first fixed releases are:

• 3.1 Patch 12
• 3.2 Patch 11
• 3.3 Patch 12
• 3.4 Patch 7
• 3.5 Patch 4

CISA moved on the same day the advisory landed. It added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026 and set a deadline of September 19, 2026 for federal civilian agencies to patch, a three-day window that signals how seriously it reads the active-exploitation claim.

How to check whether you were hit

Because there is no configuration that closes the hole, the only real mitigation short of patching is to restrict management-plane traffic to ISE with infrastructure access control lists, so the vulnerable endpoint is simply unreachable from untrusted networks. That buys time. It is not a fix.

For signs of exploitation, detection guidance circulating with the disclosure points to the appliance's own logs. Checking show logging application ise-kong/access.log | include dummyuser on the box has been cited as a way to surface probe attempts against the vulnerable endpoint. Cisco has not attributed the activity to any named threat actor, so absence of a known signature is not absence of exposure. Assume any ISE that was internet-reachable before the patch is a candidate for review.

What comes next

This single CVE arrived inside a much larger release. Cisco shipped 77 new CVEs across ISE and Secure Firewall the same week, 41 of them touching ISE and 28 touching Secure Firewall, including further 10.0 and 9.9-rated flaws for remote code execution, authentication bypass and SQL injection, as The Hacker News reported. Patching CVE-2026-76460 alone clears the one under active attack; it does not clear the batch.

The near-term picture is a patching race. With exploitation confirmed, a CVSS 10.0, and no workaround, the window between disclosure and mass scanning is the whole story. Organisations that gate their patch cycles on monthly maintenance windows are the ones this class of bug is built to catch. As of September 22, 2026 Cisco has published no indication that the fixed releases are anything other than the answer, which makes the task operational rather than uncertain: find every ISE and ISE-PIC instance, confirm its patch level against the list above, and restrict the management plane on anything that cannot be patched today. Full details and the ongoing list of fixed builds stay on Cisco's advisory.