Cisco has released emergency updates for an actively exploited zero-day vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), tracked as CVE-2026-76460 with a maximum CVSS score of 10.0. The vulnerability stems from insufficient authentication controls (CWE-648) within an API endpoint managed by the platform’s internal Kong API gateway (ise-kong). An unauthenticated, remote attacker can exploit the flaw by sending a crafted HTTP request to bypass the web-based management interface, gaining unauthorized access to privileged endpoints and achieving arbitrary command execution with root privileges on the underlying operating system.

Cisco confirmed active in-the-wild exploitation, prompting CISA to add CVE-2026-76460 to its Known Exploited Vulnerabilities catalog with an emergency remediation mandate. Because root access enables attackers to modify network access policies, extract credentials, and tamper with audit trails, Cisco warned that compromised nodes should be re-imaged and restored from backups rather than simply patched. The flaw affects ISE releases 3.1 through 3.5, with fixes delivered in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. With no workarounds available, administrators are advised to isolate management interfaces via access-control lists and audit ise-kong/access.log for anomalous queries.

Why it matters:

• Centralized policy engine subversion: Compromising Cisco ISE breaks enterprise zero-trust architectures at their foundation, enabling unauthenticated remote attackers to subvert RADIUS and TACACS+ access controls, manipulate network segmentation policies, and establish invisible persistence across corporate infrastructure.
• Urgent appliance isolation and forensic rebuilds: Organizations must immediately apply vendor patches or restrict API access via perimeter access-control lists, while forensically reviewing access.log files and re-imaging suspect nodes to guarantee the eviction of root-level implants.