Cisco spent the week of September 16, 2026 issuing back-to-back emergency patches for zero-day flaws already under attack, and the worst of the bunch could not score any higher on the industry’s severity scale. CVE-2026-76460, an authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), landed a perfect CVSS 10.0 and came with a detail that made incident responders wince: no workaround exists. The only fix is the patch itself, and Cisco says attackers were already inside customer networks using the bug before that patch shipped.
The Cisco ISE zero-day is not an isolated incident. It arrived one day after Cisco patched a second actively exploited flaw, a SQL injection bug in Secure Email Gateway, and it was bundled with eight other CVEs in the same ISE advisory set, three of them also rated critical. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog the same day it was disclosed and gave federal civilian agencies a three-day window to patch, one of the shortest remediation deadlines CISA has issued all year. This piece breaks down what happened, why Cisco’s identity infrastructure keeps landing at the top of exploited-vulnerability lists, and what it signals about where attackers are aiming next.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CVE-2026-76460 Actually Does
Cisco ISE functions as the gatekeeper for corporate networks. It decides which devices and users get access, enforces network access control (NAC) policy, and often holds the keys to segmentation across an entire enterprise. That is precisely what makes CVE-2026-76460 dangerous: it is not a bug in some peripheral feature, it is a bug in the gate itself.
Cisco’s official advisory explained the root cause in plain terms: “This vulnerability is due to insufficient authentication control on an API endpoint,” the company said, attributed to Cisco in its official vendor advisory. In practice, that means an unauthenticated, remote attacker can send one crafted HTTP request and walk away with root command execution on the appliance, no credentials required.
The flaw is tracked under CWE-648 (incorrect use of privileged APIs), and it hits ISE and ISE-PIC regardless of device configuration, meaning there is no hardening setting, feature toggle, or deployment mode that sidesteps it. Cisco’s bug tracker lists it as CSCww39530, and the company says it found the issue while working a Cisco TAC support case, a strong signal that a real customer got hit and reported in before the public advisory went out.
Timeline: How the Perfect-10 Zero-Day Unfolded
The sequence of events compressed a normally weeks-long disclosure cycle into a handful of days, and every step of it points to Cisco racing attackers rather than staying ahead of them.
- September 15, 2026: Cisco discloses and patches CVE-2026-76461, an actively exploited SQL injection zero-day in Secure Email Gateway, and releases indicators of compromise for customers to check whether their gateways were already hit.
- September 16, 2026, 16:00 GMT: Cisco publishes advisory cisco-sa-ISE-ABP-VNSW7Tn5, disclosing CVE-2026-76460 with a CVSS score of 10.0.
- September 16, 2026 (same day): CISA adds CVE-2026-76460 to the KEV catalog, confirming independent evidence of real-world exploitation.
- September 19, 2026: Federal civilian agencies’ remediation deadline, a three-day turnaround reporting described as unusually tight given the scope of enterprise ISE deployments.
- September 17-20, 2026: Security vendors including runZero, Wiz, Bitsight, and SecurityWeek publish detection guidance, IOC lists, and exposure-scanning tips as enterprise security teams scramble to inventory affected appliances.
Cisco PSIRT’s own language left little room for ambiguity about the urgency. As BleepingComputer reported, Cisco PSIRT, the company’s Product Security Incident Response Team, stated: “The Cisco PSIRT is aware of active exploitation of this vulnerability.” Cyberscoop’s reporting captured the mood inside security teams bluntly, describing the ISE bug as Cisco’s second actively exploited zero-day in as many days. That framing matters. Two unrelated Cisco products, both under live attack, both patched inside 24 hours of each other, is not the profile of a coincidence. It looks like attackers who stockpiled exploits against widely deployed enterprise gear and are now burning through them.
Which ISE Versions Are Affected, and How to Patch
Every currently supported branch of Cisco ISE and ISE-PIC needs a patch, not just the oldest ones. Cisco lists the following as the first fixed releases:
| ISE / ISE-PIC branch | Vulnerable releases | First fixed release | Workaround available |
|---|---|---|---|
| 3.1 | Up to 3.1 Patch 11 | 3.1 Patch 12 | No |
| 3.2 | Up to 3.2 Patch 10 | 3.2 Patch 11 | No |
| 3.3 | Up to 3.3 Patch 11 | 3.3 Patch 12 | No |
| 3.4 | Up to 3.4 Patch 6 | 3.4 Patch 7 | No |
| 3.5 | Up to 3.5 Patch 3 | 3.5 Patch 4 | No |
Because there is no configuration change or mitigating control that blocks the attack path, patching is the only real fix. Cisco recommends organizations that cannot patch immediately restrict management-plane API access to trusted networks only, though the company stops short of calling that a true workaround since the flaw sits in the authentication logic itself, not in network exposure.
How to Check If Your ISE Deployment Is Exposed
Security teams can query the ISE admin API directly to confirm patch level before and after applying the fix. A basic version check against the appliance looks like this:
curl -k -u admin:password \
"https://<ise-host>/ers/config/op/systemconfig/iseversion" \
-H "Accept: application/json"Teams running larger deployments should also pull logs from the ISE admin API for anomalous unauthenticated requests hitting management endpoints in the days before the patch was applied, since Cisco confirmed pre-patch exploitation occurred against at least some customers.
CISA’s Three-Day Deadline and the KEV Catalog
CISA’s KEV catalog exists to force federal agencies, and by extension a large share of the private sector that watches it as a proxy for urgency, to patch vulnerabilities with confirmed real-world exploitation. Most KEV entries carry a two- to three-week remediation window. CVE-2026-76460 got three days, a deadline reporting tied directly to the severity score and the absence of any workaround. Wiz’s vulnerability database flagged the September 19 deadline as reflecting the severity of active exploitation.
For context on how tight that window is, this site’s coverage of other 2026 KEV entries shows federal deadlines running anywhere from three days to several months depending on exploitability and blast radius, including the Citrix NetScaler bug that left 22,000 appliances exposed and the VMware vCenter flaw ransomware gangs weaponized within days of KEV addition. A three-day clock puts Cisco ISE in the same emergency tier as those incidents, arguably above them given ISE’s role as the access-control layer for the rest of the network.
The Other Eight CVEs in the Same Advisory Bundle
CVE-2026-76460 did not arrive alone. Cisco’s September 16 ISE release patched nine CVEs total as part of one advisory set, and the broader September ISE update cycle covered 20 CVEs across FMC, ISE, and Nexus Dashboard combined, 12 of them rated critical, according to SecurityWeek’s count of the release. Alongside CVE-2026-76460, the notable entries include:
- CVE-2026-76423: a second maximum-severity authentication bypass affecting ISE and ISE-PIC, patched in the same cycle.
- CVE-2026-20305 and CVE-2026-20306: command injection flaws, one in ISE diagnostic tools and one in the REST API layer.
- CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284: additional critical and high-severity issues disclosed in the same advisory window, none yet flagged in the KEV catalog as of publication.
None of the other eight CVEs carry confirmed active-exploitation status the way CVE-2026-76460 does, but researchers covering the bundle described the pattern as a warning in itself: nine flaws in one identity platform in one release cycle means the product’s attack surface is large enough that finding the tenth is only a matter of time.
A Pattern, Not a One-Off: Cisco ISE’s Repeat Zero-Day Problem
This is not the first time Cisco ISE has hit a perfect CVSS score in an actively watched advisory. In July 2025, Cisco disclosed CVE-2025-20281 and CVE-2025-20337, both also rated CVSS 10.0, both unauthenticated remote code execution bugs in ISE and ISE-PIC 3.3 and 3.4 that Cisco confirmed could be triggered pre-authentication; the company shipped fixes the same month in 3.3 Patch 7 and 3.4 Patch 2. A third flaw, CVE-2025-20282, hit ISE Release 3.4 specifically. CERT-EU flagged the 2025 batch as critical enough to warrant a continent-wide advisory update.
Cisco’s broader security posture in 2025 also included the ArcaneDoor campaign, in which a China-linked threat actor exploited CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 (CVSS 6.5) in Cisco Secure Firewall ASA and FTD software for espionage purposes, according to SecurityWeek’s reporting at the time. That same lingering interest in Cisco’s identity stack showed up again months after the July 2025 patches shipped: independent researcher SecPod only published its own writeup of CVE-2025-20337 on November 12, 2025, describing it as unauthenticated RCE and underscoring how long these bugs stay relevant to attackers and researchers well past the original advisory date. ArcaneDoor targeted firewalls rather than ISE directly, but it established a precedent: nation-state and criminal actors alike treat Cisco’s network-edge and identity products as high-value, low-effort entry points into government and enterprise networks.
| CVE | Year disclosed | CVSS | Product | Vulnerability type | Active exploitation confirmed |
|---|---|---|---|---|---|
| CVE-2026-76460 | 2026 | 10.0 | Cisco ISE / ISE-PIC | Authentication bypass | Yes |
| CVE-2026-76423 | 2026 | 10.0 | Cisco ISE / ISE-PIC | Authentication bypass | No |
| CVE-2026-76461 | 2026 | Critical | Cisco Secure Email Gateway | SQL injection | Yes |
| CVE-2025-20281 | 2025 | 10.0 | Cisco ISE / ISE-PIC | Unauthenticated RCE | Reported |
| CVE-2025-20337 | 2025 | 10.0 | Cisco ISE / ISE-PIC | Unauthenticated RCE | Reported |
| CVE-2025-20333 | 2025 | 9.9 | Cisco Secure Firewall ASA/FTD | ArcaneDoor exploitation chain | Yes, China-linked |
The pattern across both years is consistent: identity and access-control products carry the highest severity scores, and network-edge products carry the clearest nation-state attribution. Put those two data points together and the picture is a vendor whose core security product line has become one of the most consistently targeted categories in enterprise infrastructure.
Why Identity Infrastructure Is the New Prime Target
Ten years ago, the most attractive target on a corporate network was the perimeter firewall or the VPN concentrator. Today it is the identity and access-management layer, and Cisco ISE sits at the center of that shift for a simple reason: it does not just guard a door, it decides who gets a key. Compromise ISE with root access and an attacker inherits the ability to add rogue devices to trusted network segments, issue bogus certificates, or quietly disable the policy enforcement that is supposed to catch lateral movement elsewhere in the environment.
Researchers who cover the identity-security space have argued the identity infrastructure attack surface is under-defended relative to how much trust organizations place in it, describing platforms like ISE as the gatekeeper that becomes the door once an attacker learns how to bypass its authentication layer. That framing lines up with a broader industry shift this site has tracked through 2026, from CAASM platforms racing to inventory exposed assets to identity governance vendors expanding beyond human accounts into non-human identity security, an area covered in this site’s comparison of NHI security vendors after 2026’s acquisition wave.
Enterprise Impact: What a Root-Level ISE Breach Actually Costs
Cisco has not published exposure figures for how many organizations run vulnerable ISE deployments, and neither CISA nor independent researchers have released a confirmed Shodan or Censys count of internet-facing appliances tied to this specific advisory. That absence of a hard number is itself notable. ISE is typically deployed on internal management networks rather than exposed directly to the internet, which limits the pool of opportunistic drive-by attackers but does nothing to protect against an attacker who has already gained a foothold elsewhere and is pivoting toward the identity layer, a scenario multiple security vendors flagged as the more realistic exploitation path for this bug.
| Factor | Why it raises breach cost |
|---|---|
| Root-level access | Attacker gains full control of the appliance, not a limited service account |
| No workaround | Organizations cannot mitigate without patching, extending the exposure window |
| Network-wide policy control | ISE governs NAC rules across every connected segment, multiplying blast radius |
| Three-day KEV deadline | Forces emergency change-control processes, raising operational cost of remediation |
| Repeat vendor pattern | Second Cisco perfect-10 ISE bug in 14 months increases insurer and auditor scrutiny |
Incident-response firms tracking ransomware trends this year have repeatedly found that downtime, not the ransom demand itself, drives the bulk of breach costs. This site’s own analysis of 2026 ransomware economics found downtime running roughly 50 times higher than the average ransom payment, and a compromised ISE deployment is exactly the kind of incident that produces extended downtime, since restoring trust in an identity platform after a root-level breach typically means a full rebuild rather than a simple patch-and-restart.
The Broader September 2026 Patch Storm
Cisco’s ISE emergency did not happen in isolation. The same week produced a cluster of actively exploited flaws across major vendors, underscoring how crowded the zero-day landscape has become heading into Q4 2026. Microsoft’s September Patch Tuesday, covered separately on this site in the breakdown of the month’s record-setting vulnerability count, fixed two actively exploited local privilege-escalation zero-days: CVE-2026-85880, a Windows ALPC heap buffer overflow, and CVE-2026-81963, a Windows Update Stack flaw researchers called the first exploited zero-day of its kind since 2022.
Elsewhere, researchers disclosed StyleSmuggler, an unauthenticated zero-day affecting current versions of Magento Open Source and Adobe Commerce with no official vendor patch available at time of reporting, and ShieldCrash, a proof-of-concept suggesting Microsoft Defender remained vulnerable to arbitrary SYSTEM-level file reads even after an earlier fix for a related flaw dubbed ShieldBreak. Separately, threat-intel reporting flagged FalconFlank, a privilege-escalation technique against CrowdStrike Falcon on Windows 11 25H2 and Windows Server 2025, plus a pair of SonicWall SMA zero-days (CVE-2026-83548, a pre-authentication SSRF flaw rated CVSS 10.0, and CVE-2026-83549) and a critical JFrog Artifactory authentication bypass tracked as CVE-2026-82329.
Taken together, this stretch of September 2026 has produced more perfect-10 and actively exploited zero-days across core enterprise infrastructure than any comparable window this site has tracked in 2026, a run that also included this site’s coverage of the CVSS 10.0 GitLab flaw already under exploitation and the fourth emergency hotfix N-able shipped for N-central this year.
Competitive Comparison: How Cisco ISE Stacks Up Against Rival NAC Platforms
Cisco ISE competes with network access control platforms from Aruba (ClearPass), Fortinet (FortiNAC), and Microsoft’s Entra-integrated access control tools, and this year’s disclosure record gives buyers a genuine data point for that comparison rather than a marketing one. None of Cisco’s direct NAC competitors disclosed a CVSS 10.0 authentication bypass with confirmed active exploitation in the same September 2026 window, though all NAC vendors carry their own patch histories and none should be treated as inherently safer without a like-for-like audit. What sets this incident apart is less the existence of a critical bug, which happens to every vendor eventually, and more the combination of a perfect severity score, zero workaround, and a second Cisco identity-platform zero-day inside 24 hours.
For enterprise security teams currently running ISE, the practical question is not necessarily whether to switch vendors after one bad week, but whether Cisco’s cadence of critical ISE disclosures, three perfect-10 bugs in the platform across 2025 and 2026 alone, changes the calculus on how much unmonitored trust the platform deserves without compensating controls like network segmentation around the appliance itself and continuous API-traffic monitoring.
What Security Researchers Are Saying
Cisco’s own advisory language has been unusually direct for a vendor disclosure. In its official vendor advisory, Cisco stated: “An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint.” Independent coverage from Cyberscoop noted that researchers have not tied CVE-2026-76460 to any named threat actor or ransomware group, but flagged that Cisco ISE vulnerabilities have become a recurring target, a characterization that lines up with the 2025-2026 pattern documented above.
The Register, in its coverage of the disclosure, noted the timing: this marked the second Cisco zero-day patched inside two days, and the outlet’s headline described the bug simply as a perfect 10, a framing that stuck across most subsequent coverage of the incident. Cisco’s advisory left no ambiguity about the stakes of a successful attack chain, stating plainly that “a successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface,” a description that matches the root-level outcomes independent researchers have since confirmed in their own analysis.
Historical Context: From ArcaneDoor to a Perfect-10 Identity Bypass
Cisco’s edge and identity products have been under sustained pressure since the original ArcaneDoor campaign first surfaced against ASA and FTD firewalls. That campaign, attributed to a China-nexus espionage actor, established that Cisco’s network infrastructure was a strategic target for state-level intelligence gathering, not just opportunistic cybercrime. The 2025 ISE disclosures shifted the pattern from firewalls to identity management, and the September 2026 disclosures confirm that shift is now the dominant trend rather than an exception.
What changed between 2025 and 2026 is speed. Last year’s flagship ISE bug, CVE-2025-20337, was disclosed and patched in the same month, July 2025, with fixes landing in 3.3 Patch 7 and 3.4 Patch 2, yet outside research into the flaw kept surfacing afterward, with SecPod publishing its own unauthenticated-RCE analysis as late as November 12, 2025, roughly four months after Cisco’s advisory. This year’s flagship bug shipped with zero mitigation options and a three-day federal deadline, a compression that reflects both faster attacker adoption of new exploits and CISA’s growing willingness to set aggressive KEV timelines for identity-layer infrastructure specifically.
Five Predictions for Identity Infrastructure Security Through 2027
- More perfect-10 ISE-class disclosures are coming. Nine CVEs in one advisory bundle, plus a documented multi-year pattern, points toward Cisco’s identity platform staying a top disclosure source through 2027 rather than settling down after this patch cycle.
- CISA’s KEV deadlines for identity products will keep shrinking. The three-day window set for CVE-2026-76460 is likely to become the new baseline for future no-workaround, root-access identity bugs, not an outlier.
- Enterprises will accelerate NAC segmentation projects. Expect a wave of enterprise architecture reviews placing ISE and similar platforms behind stricter internal network segmentation, treating the identity layer as a resource that needs to be firewalled rather than implicitly trusted.
- Attribution will surface eventually. Given the pattern of nation-state interest in Cisco’s identity and edge products established by ArcaneDoor, expect a threat-intel firm to publish attribution for CVE-2026-76460 exploitation within the next two to four months.
- Rival NAC vendors will use this disclosure in sales pitches. Aruba, Fortinet, and Microsoft’s competing access-control offerings are likely to reference Cisco’s 2025-2026 ISE disclosure record directly in competitive enterprise sales conversations over the next two quarters.
What Security Teams Should Do Right Now
For any organization running Cisco ISE or ISE-PIC in any supported branch, the response checklist is short and non-negotiable given the absence of a workaround:
- Identify every ISE and ISE-PIC instance across the environment, including branches used in test, staging, and disaster-recovery environments that are easy to overlook during emergency patch cycles.
- Apply the fixed release matching each branch (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4) immediately rather than waiting for a scheduled maintenance window.
- Review admin API logs for the period before patching for unauthenticated requests to management endpoints, since Cisco has confirmed pre-patch exploitation occurred against at least some customers.
- Restrict management-plane access to trusted internal networks as a compensating control while patch rollout is in progress, understanding this reduces but does not eliminate risk.
- Cross-check the other eight CVEs in the same advisory bundle, since several remain unpatched risk even if they are not yet confirmed as actively exploited.
Frequently Asked Questions
What is CVE-2026-76460?
CVE-2026-76460 is an authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), rated CVSS 10.0. It allows an unauthenticated, remote attacker to send a crafted API request and gain root-level command execution on the appliance.
Is the Cisco ISE zero-day being actively exploited?
Yes. Cisco PSIRT confirmed active exploitation in its September 16, 2026 advisory, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, which requires independent confirmation of real-world attacks before an entry is added.
Is there a workaround for CVE-2026-76460?
No. Cisco’s advisory states no workarounds are available. The only remediation is applying the patched release for each affected ISE or ISE-PIC branch.
Which Cisco ISE versions need to be patched?
All currently supported branches are affected regardless of configuration: 3.1 (fixed in Patch 12), 3.2 (Patch 11), 3.3 (Patch 12), 3.4 (Patch 7), and 3.5 (Patch 4).
What is the CISA KEV deadline for this vulnerability?
CISA set a remediation deadline of September 19, 2026, three days after the vulnerability was added to the KEV catalog on September 16, 2026, one of the shortest windows CISA has issued for a network infrastructure vulnerability this year.
Has a threat actor or ransomware group been linked to this bug?
No public attribution has been confirmed as of publication. Cisco and independent researchers have not named a specific threat actor, ransomware group, or nation-state campaign behind the observed exploitation.
How many CVEs were patched in the same Cisco ISE advisory bundle?
Cisco’s September 16, 2026 ISE release addressed nine CVEs in total within the same advisory set, and the broader September update across ISE, FMC, and Nexus Dashboard covered 20 CVEs, 12 of them critical.
How does this compare to Cisco’s 2025 ISE vulnerabilities?
Cisco disclosed two other CVSS 10.0 ISE bugs in July 2025, CVE-2025-20281 and CVE-2025-20337, both unauthenticated remote code execution flaws that Cisco patched that same month in 3.3 Patch 7 and 3.4 Patch 2 (independent researcher SecPod published its own confirmation of CVE-2025-20337 as unauthenticated RCE on November 12, 2025). CVE-2026-76460 marks the third perfect-severity Cisco ISE disclosure across the two years, reinforcing a pattern of identity infrastructure becoming a primary target category.
