Cisco patches actively exploited ISE authentication bypass

Cisco has published fixes for a maximum-severity flaw in Identity Services Engine (ISE) and the ISE Passive Identity Connector that lets a remote attacker bypass authentication on an API endpoint. According to the original report, Cisco's own incident response team has confirmed active exploitation, and CISA added the issue to its Known Exploited Vulnerabilities catalog with a three-day patching deadline for US federal agencies. There are no workarounds — updating is the only remediation Cisco offers.

What happened

The flaw, tracked as CVE-2026-76460, stems from insufficient authentication control on an ISE API endpoint. A crafted request is enough to reach the web-based management interface without valid credentials, and the report notes this works regardless of how the appliance is configured. Fixed releases are listed per branch: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.

Cisco has published indicators of compromise and advises checking access.log on every node for suspicious usernames. Where compromise is suspected, the recommendation is blunt: re-image the nodes and restore from backups. Because successful exploitation can lead to root-level command execution, attackers may have cleaned up local traces, so firewall and network logs should be cross-checked for unexpected transfers to or from external addresses.

This sits inside a larger batch. The report says Cisco patched a second maximum-severity authentication bypass (CVE-2026-76423) and five further critical ISE issues the previous day; those are not currently flagged as exploited. A similar ISE zero-day in July 2025 was used to plant a web shell disguised as a legitimate component.

Why it matters

ISE is not a peripheral system. It decides which users and devices get onto the network, and in many organisations it is the enforcement point behind a Zero Trust design. An authentication bypass there does not just expose one appliance — it undermines the component that other controls trust. For smaller teams the practical problem is that such appliances are often installed once, integrated deeply, and then left on an annual maintenance rhythm. That rhythm does not survive a confirmed in-the-wild exploit.

The second complication is evidence. Root access means local logs cannot be treated as authoritative, so if you have no off-box log retention, you may not be able to answer the question "were we hit?" with any confidence. That turns a patching task into a much more expensive rebuild decision.

What to do

• Identify every ISE and ISE-PIC node, including lab and standby instances, and move to the fixed patch level for your branch. Plan the whole batch of critical fixes in one window rather than only this CVE.
• Before or during the upgrade, review access.log on each node against Cisco's published indicators, and check firewall and network logs for unusual outbound traffic from the appliances.
• Confirm you have working, tested backups and a documented re-imaging path. If activity looks suspicious, treat rebuild from backup as the default, not the fallback.
• Verify that management interfaces of ISE and comparable appliances are not reachable from untrusted networks, and that their logs ship to a system outside the appliance itself.