Cisco ISE Zero-Day Authentication Bypass Under Active Attack

Cisco has issued an urgent warning regarding a critical security flaw, CVE-2026-76460 (CVSS 10.0), impacting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The vulnerability stems from insufficient authentication controls on a specific API endpoint, allowing unauthenticated remote attackers to bypass the web management interface. Cisco PSIRT and CISA have confirmed active exploitation in the wild, with attackers successfully obtaining root privileges on affected nodes.

Technical analysis reveals that threat actors may attempt to hide their presence by deleting logs after achieving command execution. This incident follows a pattern of ISE targeting, similar to the CVE-2025-20337 exploitation that deployed the 'IdentityAuditAction' web shell. Because Cisco ISE is a central pillar for Zero Trust architectures and network access control, compromise of this platform represents a total loss of trust for the affected network environment.

CISA has added this flaw to the Known Exploited Vulnerabilities (KEV) catalog with an accelerated remediation deadline. Organizations using Cisco ISE must upgrade to fixed releases immediately, as no effective workarounds exist beyond infrastructure-level access control lists (iACLs).