Cisco Patches Critical ISE Zero-Day Flaw (CVE-2026-76460)
Cisco Patches Critical ISE Zero-Day Under Active Exploitation
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
On September 16, 2026, Cisco released an emergency security advisory for a critical, actively exploited zero-day vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products. The vulnerability, tracked as CVE-2026-76460, has been assigned the highest possible CVSS score of 10.0. It allows a remote, unauthenticated attacker to bypass authentication controls and achieve complete system compromise with root-level privileges. Due to confirmed in-the-wild exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch by September 19, 2026. Cisco has released software updates and strongly urges all customers to apply them immediately as there are no effective workarounds.
Vulnerability Details
The vulnerability resides in an API endpoint of the Cisco Identity Services Engine (ISE) web-based management interface. The flaw is due to insufficient authentication checks, allowing an unauthenticated attacker to craft a specialized HTTP request to bypass security controls. A successful exploit grants the attacker unauthorized access to the system, which can be escalated to execute arbitrary commands with root privileges. This provides the attacker with full control over the affected device, enabling them to alter configurations, exfiltrate data, and remove logs to hide their tracks.
- CVE ID:
CVE-2026-76460 - CVSS Score: 10.0 (Critical)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
Affected Systems
The vulnerability affects the following Cisco products and versions:
- Cisco Identity Services Engine (ISE): Releases 3.0 through 3.5
- Cisco ISE Passive Identity Connector (ISE-PIC): Releases 3.0 through 3.5
Cisco has provided fixed software releases for ISE versions 3.1 and newer. Customers running older, unsupported versions are advised to migrate to a supported release.
Exploitation Status
Cisco's Product Security Incident Response Team (PSIRT) has confirmed active exploitation of this vulnerability in the wild. While specific details of the attacks and the threat actors involved have not been disclosed, the confirmation of active exploitation significantly increases the urgency for all organizations to apply the available patches. The addition to the CISA KEV catalog further validates the immediate and ongoing risk posed by this flaw.
Impact Assessment
A successful exploit of CVE-2026-76460 would have a devastating impact on an organization's security posture. Cisco ISE is a critical network access control (NAC) and policy enforcement platform, often acting as the central gatekeeper for network access. An attacker with root access to an ISE appliance could:
- Modify network access policies to allow unauthorized devices and users onto the network.
- Create rogue administrator accounts for persistent access.
- Disable security logging and monitoring to evade detection.
- Use the compromised ISE server as a pivot point to launch further attacks against the internal network.
- Exfiltrate sensitive network configuration data, user credentials, and other confidential information.
Given its role, compromising an ISE server effectively dismantles a core pillar of an organization's network security architecture.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
- Log Analysis: Cisco advises administrators to review access logs for suspicious usernames. Security teams should execute the following command on the ISE CLI to check for potential indicators of compromise:
The presence of unusual or repeated failed login attempts for non-existent users could indicate scanning or exploitation activity.show logging application ade/ADE.log | include "User with such username not found" - Network Traffic: Monitor for anomalous HTTP/HTTPS requests to the ISE management interface API endpoints from untrusted or unexpected IP addresses. Baseline normal administrative access patterns and alert on deviations.
- Configuration Changes: Monitor for unauthorized changes to ISE policies, administrator accounts, or system configurations.
Detection Methods
- Vulnerability Scanning: Use vulnerability scanners with updated plugins to identify affected Cisco ISE versions within your environment.
- Log Monitoring: Implement SIEM rules to alert on the specific log message provided by Cisco:
"User with such username not found". Correlate these alerts with source IP reputation and frequency to detect brute-force or targeted exploitation attempts. - Network Traffic Analysis: D3-NTA: Network Traffic Analysis should be employed to scrutinize traffic to and from ISE management interfaces. Look for requests to unusual API endpoints or patterns indicative of scanning.
- File Integrity Monitoring: Monitor critical system files on the ISE appliance for unauthorized modifications, which could indicate a successful compromise.
Remediation Steps
- Patch Immediately: The primary remediation is to upgrade to a fixed software release as detailed in the Cisco security advisory. This is the only way to fully address the vulnerability.
- Restrict Access: As a temporary mitigation, implement infrastructure access control lists (iACLs) to limit access to the ISE management interface. Only allow connections from trusted IP addresses and dedicated management subnets. This is a D3-NI: Network Isolation strategy.
- Hunt for Compromise: After patching, conduct a thorough investigation for signs of compromise using the detection methods outlined above. If a compromise is suspected, activate your incident response plan.
- Verify Patches: After deployment, verify that the patch has been successfully applied and the system is running the fixed software version.
Timeline of Events
Article Updates
September 19, 2026
New details on CVE-2026-76460, including enhanced hunting hints, detection methods, and remediation steps, plus context on its zero-day discovery.
This update provides additional context on the CVE-2026-76460 zero-day, noting its discovery during a customer support case and confirmation of active exploitation prior to patch release. Crucially, it offers significantly enhanced and structured hunting hints, including specific URL patterns, network traffic indicators, and log sources for detection. Remediation guidance now explicitly references D3FEND strategies, and impact assessment highlights the concern of log manipulation, advising checks on upstream network devices for suspicious activity. These details improve an organization's ability to detect and respond to potential compromises.
Update Sources:
September 20, 2026
New report adds context on recent Cisco zero-days, mentioning CVE-2026-76461, and provides expanded hunting hints for CVE-2026-76460.
A new report provides additional context regarding recent Cisco vulnerabilities, noting that CVE-2026-76460 is the second major zero-day from Cisco in a short period, following a recent SQL injection flaw (CVE-2026-76461) in its Secure Email Gateway. The article also expands on hunting hints, suggesting monitoring Cisco ISE M&T logs for unexpected requests, specific API endpoint paths, and new internal devices appearing on the network without proper registration, offering more detailed detection strategies for the actively exploited ISE vulnerability.
Update Sources:
Timeline of Events
Cisco releases a security advisory for CVE-2026-76460, confirming active exploitation.
CISA adds CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog.
Deadline for U.S. Federal Civilian Executive Branch agencies to apply the patch for CVE-2026-76460.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.