Cisco has released emergency patches for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) addressing CVE-2026-76460, a critical zero-day vulnerability scored at CVSS 10.0 that is already being exploited in real-world attacks.
The flaw originates from insufficient authentication controls in an API endpoint. In practice, a remote attacker can bypass authentication on the API gateway without any credentials, gaining unauthorized access to the system and potentially evading the web administration interface.
Once inside, attackers may chain the initial intrusion with additional actions to execute commands with root privileges. This level of access facilitates erasing traces, hiding indicators of compromise, and manipulating the platform at will.
The vulnerability impacts ISE and ISE-PIC regardless of specific configuration settings. Cisco has confirmed there are no alternative mitigations that eliminate the risk, making installation of the corrected versions the only effective defense.
Patches have been issued for multiple branches: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. The Cisco ISE 3.0 branch has reached end of software maintenance, requiring organizations still using it to plan migration to a supported branch containing the fix.
While deploying updates, Cisco recommends reviewing the ise-kong access.log and access logs on each node to identify suspicious usernames in API gateway requests. These logs should be correlated with external perimeter and firewall logs to detect unexpected data transfers to external IP addresses.
If solid evidence of exploitation or compromise is found, the recommended response includes reinstalling affected nodes and restoring configuration from backups. Additionally, applying iACLs to minimize management and control-plane traffic can help reduce the attack surface during patch deployment in environments where service interruptions are difficult.
