Cisco ISE is a perfect 10 this week, and it is already being used

Cisco admins who spent Monday on email gateways now have a Thursday problem. Identity Services Engine, the box that decides who is allowed on the network, has a CVSS 10 authentication bypass under active attack. CVE-2026-76460. No login. A crafted request to an API is enough to skip the web management interface. Cisco says that can become root. CISA put it on the Known Exploited Vulnerabilities list the same day Cisco shipped the advisory.

What Cisco published

The bug is insufficient authentication on an API endpoint. It hits ISE and ISE Passive Identity Connector in every configuration. There is no workaround that closes it. Infrastructure ACLs that keep the management plane off the open internet are a temporary fence, not a fix.

Fixed trains: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4. Release 3.0 is out of software maintenance. If you are still there, the path is migrate, not hope.

PSIRT learned about in-the-wild use while working a TAC case. Same pattern as last week's Secure Email Gateway zero-day (CVE-2026-76461). That federal due date is today. Two Cisco management-plane emergencies in one week is not a coincidence. Attackers go where one appliance speaks for the rest of the estate.

Why ISE is worse than another appliance

ISE is network access control. If it falls, the attacker is not just on a mail filter. They are next to the system that grants or denies 802.1X, VPN, and guest access. Root on that host is a license to rewrite who is trusted.

Cisco is blunt about forensics. Root can hide or delete indicators on the box. Hunt in access.log for odd usernames (their example is a dummy user string). Do that on every node in a distributed deployment. Then look at firewall and network logs outside ISE for unexpected uploads or downloads. If you only trust the appliance's own log, you are reading a document the attacker can edit.

If you find signs of abuse, Cisco's advice is re-image and restore from a configuration backup. That only works if the backup was not sitting on the same compromised host.

What we would do today

• Inventory every ISE and ISE-PIC node. Confirm version. Confirm the management interface is not on the internet.
• Patch to the matching fixed train this week. iACLs until the change window opens.
• Review access.log on each node. Cross-check perimeter logs for odd egress from the ISE addresses since at least early September.
• If ISE binds to Active Directory or stores admin secrets, treat a confirmed hit as an identity incident, not a reboot.
• While you are in the change calendar, finish the Secure Email Gateway upgrade if that is still open. Thursday was the advertised deadline for a reason.

Bottom line

A 10.0 on the NAC platform, found in a support case, already exploited. Forensic Five reviews internet-facing management planes for Canadian organizations and writes down what was reachable. From St. Albert, Alberta. Scope first. Then the patch.