CVE-2026-76460: A Second Cisco Zero-Day This Week, Now in Identity Services Engine

CVE-2026-76460 is an authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector, and it scores a perfect CVSS 10.0. An unauthenticated attacker can send a crafted request to a Cisco ISE API endpoint and bypass the web-based management interface entirely, with successful exploitation potentially reaching root command execution. Cisco found this one the same way it found last week's Secure Email Gateway zero-day, CVE-2026-76461: while resolving a Cisco Technical Assistance Center support case that turned out to already be an active intrusion. CISA added CVE-2026-76460 to its KEV catalog on September 16, 2026, giving federal agencies until September 19 to patch. Two maximum-severity, unauthenticated Cisco zero-days, discovered the same way, inside the same week, is worth pausing on before getting into the specifics of this one.

What the vulnerability is

The flaw, tracked under CWE-648 (Incorrect Use of Privileged APIs), comes from insufficient authentication controls on an API endpoint in Cisco ISE. Cisco's advisory is direct about the mechanism: an attacker sends a specially crafted request to the affected endpoint and gains unauthorized access to the device by bypassing the web-based management interface, no credentials involved.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a scope change on top of the usual unauthenticated, no-interaction, low-complexity profile, and Cisco has confirmed that successful exploitation can escalate to command execution with root privileges. Root access on an ISE node means an attacker can rewrite policy, create persistence, harvest credentials passing through the system, or pivot from the appliance into the rest of the network it is supposed to be gatekeeping. There is no workaround. Cisco's only mitigation is restricting management-plane access with infrastructure access control lists (iACLs) while you patch, and Cisco is explicit that this is temporary, not a fix.

Who is affected

CVE-2026-76460 affects Cisco ISE and ISE Passive Identity Connector regardless of configuration, across releases 3.1 through 3.5. Fixes are available in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. ISE Release 3.0 is also exposed but has already reached end of software maintenance, Cisco's guidance there is to migrate to a supported, patched release rather than wait for a 3.0 fix that isn't coming.

Because ISE exists specifically to authenticate users and devices onto the network, there is not much of a narrowing condition here either: if you run it, the component that was just bypassed is the same one doing that job for you every day.

One zero-day is bad luck, two is a pattern

One CVE discovered through an active intrusion is a bad week. Two, in different products, discovered the same way, seven days apart, is a pattern worth reading on its own. Both CVE-2026-76461 (Secure Email Gateway, CVSS 9.8) and CVE-2026-76460 (ISE, CVSS 10.0) surfaced because Cisco's TAC was resolving a support case that turned out to already be a live compromise, not because a researcher reported a bug ahead of any exploitation. Both are unauthenticated, both reach root or full device control, and both shipped without a usable workaround.

That repetition changes how you should treat the next Cisco advisory this month, not just this one. When a vendor's own incident response keeps surfacing zero-days in edge and identity infrastructure within the same short window, it is a reasonable signal that attackers are actively probing that vendor's products right now, not a coincidence of unrelated bugs landing close together. If you run Cisco ISE, Secure Email Gateway, or similar edge-facing Cisco appliances, this is a good week to treat every Cisco security advisory as higher priority than your normal triage would rank it, independent of each individual CVSS score.

Reading it on VulnTracker

On VulnTracker, CVE-2026-76460's page carries the CVSS 10.0 CRITICAL score, CWE-648, and the Cisco ISE and ISE Passive Identity Connector product tags, with a Track button for alerts on Cisco's next move. The Newsroom tab surfaces coverage as it lands, both Cyber Security News and The Hacker News confirmed active exploitation within a day of Cisco's advisory, so the page reflects real-time reporting rather than a static database entry. For a fast-moving, actively exploited disclosure like this one, that live newsroom view is more useful than the score alone.

What to do

Upgrade Cisco ISE or ISE-PIC to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4, whichever applies, or migrate off 3.0 to a supported release entirely. If you cannot patch immediately, restrict management and control-plane traffic to the appliance with infrastructure ACLs, allowing only trusted, essential systems to reach it, and treat that as a stopgap, not a fix.

Because Cisco has confirmed active exploitation, check for prior compromise rather than assuming a clean patch closes the book. Cisco's own recommendation is to review access.log for suspicious usernames and unexpected API activity on every node in a distributed deployment, using show logging application ise-kong/access.log | include dummyuser as a starting query, and to pull support bundles with debug logging enabled for the fuller API gateway picture. As with the Secure Email Gateway case, Cisco warns that root-level attackers can remove or hide their own indicators, so cross-check firewall and network logs outside the appliance for unexpected outbound connections or uploads. If you find anything, Cisco's guidance is to reimage the affected nodes and restore configuration from a known-good backup rather than trust the box in place.

Takeaway

CVE-2026-76460 is bad on its own terms: unauthenticated, root-capable, no workaround, already exploited. It is worse read next to CVE-2026-76461 from the same vendor the same week. A single score tells you how bad one bug is. Watching the pattern across a vendor's disclosures in a short window tells you something a single score never can: whether you are currently on someone's target list.

If you run Cisco ISE, sign up at vulntracker.io to track CVE-2026-76460 and get notified as Cisco's guidance, and the rest of this month's Cisco advisories, develop.

References: Cisco Security Advisory: Identity Services Engine Authentication Bypass Vulnerability · NVD, CVE-2026-76460 · The Hacker News: Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks