Cisco ISE is the policy engine that decides who gets on your network and who does not. On September 16, 2026, Cisco confirmed that attackers are already exploiting a flaw in that engine, one that scores a perfect 10.0 on the CVSS scale and hands them root on the appliance. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog the same day, giving federal agencies three days to patch or mitigate. If you run Cisco ISE or ISE-PIC in production, this is a drop-everything moment for your team and your change advisory board alike.
A CVSS 10.0 auth bypass on your network access control platform, with active exploitation and no workaround, means the device enforcing your zero trust policy could be the one betraying it.
What exactly does CVE-2026-76460 let an attacker do?
The vulnerability sits in an API endpoint of Cisco Identity Services Engine and the ISE Passive Identity Connector. That endpoint does not enforce sufficient authentication controls, which means an unauthenticated, remote attacker who can reach the management interface can send crafted API requests and bypass the web-based management interface entirely. Cisco's security advisory explains that successful exploitation grants unauthorized access to the affected device.
From there, attackers can execute commands with root privileges, which gives them full control of the appliance and the ability to delete or hide indicators of compromise before you ever start looking. The flaw is classified as CWE-648, incorrect use of privileged APIs. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which translates to: network-reachable, low complexity, no privileges required, no user interaction, and complete impact across confidentiality, integrity, and availability.
Both ISE and ISE-PIC are affected regardless of device configuration. There is no setting you can flip to make this go away. Cisco shipped fixed releases across five version trains, which the chart below breaks out by required patch level.
How widespread is the exposure in practice?
Cisco ISE is deployed widely in enterprise environments as a centralized policy platform for network access control, endpoint profiling, and Zero Trust enforcement. It is the kind of product that sits at the core of how an organization decides who can reach what. That makes the blast radius of a root-level compromise significant: an attacker with root on ISE can alter network access policies, see identity data for every user and device, and potentially pivot deeper into the network.
CISA's KEV catalog addition confirms that exploitation is not theoretical. The agency gave federal agencies a September 19, 2026 deadline under Binding Operational Directive 26-04, which is the three-day window CISA uses for the most urgent vulnerabilities. Private sector organizations have no such mandate but face the same exposure window.
This is not the first time Cisco ISE has been in this position. In July 2025, threat actors exploited another maximum-severity ISE zero-day, CVE-2025-20337, to deploy a custom web shell disguised as a legitimate ISE component called "IdentityAuditAction." That attack demonstrated that ISE appliances are high-value targets for persistent access, not just data theft. Over the last five years, CISA has tagged 99 security flaws in Cisco products as actively exploited, including seven that were used in ransomware campaigns. Cisco's infrastructure gear sits at the edge and core of thousands of networks, and attackers know it.
For broader context on how CISA's KEV catalog drives patching priorities across network infrastructure, our analysis of CISA KEV vulnerabilities putting edge gear on watch covers the pattern.
Why does a compromised ISE appliance threaten your whole network?
Consider what ISE actually does in your environment. It profiles endpoints, authenticates users, assigns them to the right VLAN or security group, and decides whether a device is compliant enough to connect. When you build Zero Trust architecture around ISE, you are trusting it to be the arbiter of who belongs on your network. If an attacker has root on that system, your Zero Trust policy is now their policy.
They can do several things with that access:
- Alter access policies to grant themselves or their tools persistent network access from any device.
- Exfiltrate identity data, including usernames, endpoint profiles, and authentication logs that reveal the structure of your network and its users.
- Pivot laterally by using ISE's integration points with Active Directory, RADIUS, and other identity stores to reach credentials and systems beyond the appliance itself.
- Clean up after themselves, because root access lets attackers delete logs, remove uploaded files, and erase indicators of compromise before your SIEM or EDR ever triggers.
The last point matters operationally. Cisco explicitly warns that successful exploitation can allow attackers to hide or delete indicators of compromise, which means you cannot assume a clean log means a clean system. When the attacker has root, the absence of evidence in the local log file is meaningless.
This is also a supply chain consideration for anyone who relies on managed service providers or shared infrastructure. If your MSP runs ISE on your behalf, their patch status is your patch status. You need to confirm with them directly, not assume it is handled.
What should you do right now?
The fix is straightforward in concept and painful in execution: upgrade every ISE and ISE-PIC node to the fixed release for your version train. The patched versions are ISE 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12. No workarounds exist. Cisco notes that applying infrastructure access control lists to restrict traffic to the affected device can prevent remote exploitation, but this is a temporary mitigation, not a fix. If your ISE management interface is reachable from anything other than a tightly controlled administrative network, that is a problem you should have fixed already and now have no excuse to leave open.
For detection, Cisco's advisory instructs administrators to review access.log files for suspicious usernames on every node in the deployment. In a distributed ISE setup, that means checking logs on each node, not just the primary. The presence of any unexpected entry in the access log may indicate malicious activity.
If you find suspicious entries, Cisco strongly recommends re-imaging the affected nodes and restoring from a configuration backup. Do not try to clean a compromised ISE appliance in place. Root-level access means an attacker could have modified binaries, planted web shells, or altered policies in ways that survive a simple log purge. You should also cross-check firewall and network logs outside the ISE device itself, looking for unexpected uploads or downloads to and from external or suspicious IP addresses. Because attackers can scrub local IoCs, the evidence of compromise may live on your perimeter devices rather than on the appliance.
This detection guidance echoes what we saw with the Cisco FMC ransomware exploitation earlier this year: when network infrastructure gets root-level compromise, the forensic trail often leads away from the device, not toward it.
How does this fit the broader Cisco patch picture?
This zero-day did not arrive alone. On the same day, Cisco patched a second maximum-severity authentication bypass flaw, CVE-2026-76423, along with five other critical issues in ISE and ISE-PIC: CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, and CVE-2026-20284. None of those additional CVEs have been flagged as actively exploited yet, but they sit in the same product and the same advisory. Your patch plan should cover all of them, not just the KEV entry. If you are upgrading ISE to fix CVE-2026-76460, land on a release that closes the full set, not one that patches only the exploited flaw and leaves the others open for the next attacker to find.
The pattern is familiar to anyone tracking Cisco vulnerabilities this year. The Cisco Secure Email Gateway zero-day and the Cisco Unified CM deadline both followed similar arcs: critical CVE, active exploitation, CISA KEV, and a short clock for operators. Network infrastructure is where attackers go, and patching it is where defenders need to be fastest.
The device enforcing your perimeter is the target
Your network access control platform is the system that decides who is trusted and who is not. When it is compromised with root, your trust model is compromised with it. Patch now, check your logs on every node, and assume the attacker is already ahead of you.
