Cisco released emergency fixes after attackers were found exploiting a critical flaw in Cisco Identity Services Engine and ISE Passive Identity Connector. The bug, CVE-2026-76460, is a CVSS 10.0 authentication-bypass issue in an API endpoint that allows remote, unauthenticated crafted requests to reach the management interface; Cisco warns successful exploitation can lead to root-level command execution. Fixed versions include ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12, and CISA added it to KEV with a three-day federal patch deadline.
Why it matters: Organizations using Cisco ISE or ISE-PIC should treat this as an immediate patching priority because attackers can get in without valid credentials and potentially erase traces afterward. Restrict access with infrastructure access control lists if needed, patch now, and review access, network, and firewall logs for signs of compromise.
Lawrence Abrams
2026.09.23
75% relevant
The article reiterates that Cisco Identity Services Engine CVE-2026-76460 was already exploited when disclosed and places it in the broader pattern of attackers targeting infrastructure management systems, reinforcing urgency around the ISE zero-day.
2026.09.17
97% relevant
This article is a direct report on the same underlying event and adds concrete operational details including that the flaw is in an API with insufficient authentication, affects all configurations, has no workaround beyond infrastructure ACL restrictions, may let attackers erase traces, and is fixed in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
Sergiu Gatlan
2026.09.17
99% relevant
This article is a direct report on the same event: Cisco's disclosure and patching of actively exploited CVE-2026-76460 in Cisco ISE and ISE-PIC. It adds patch-version details, Cisco's incident-response guidance including log review and re-imaging advice, and notes CISA's three-day KEV remediation deadline.
info@thehackernews.com (The Hacker News)
2026.09.17
98% relevant
This article appears to cover the same underlying event: Cisco warning about an actively exploited new zero-day authentication bypass in ISE/ISE-PIC with maximum severity. It adds that Cisco publicly warned of active attacks around the flaw and frames it as a newly disclosed zero-day before or alongside broader patch coverage.
Ionut Arghire
2026.09.17
100% relevant
This article appears to be the first tracked item here for the active exploitation and emergency patching of Cisco ISE/ISE-PIC zero-day CVE-2026-76460.
← Back to all stories