CVE Tools
Track your stack

Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

SecurityWeekBy Ionut Arghire

Reported exploitedIdentity Services Engine (ISE)ISE Passive Identity Connector (ISE-PIC)

Our summary

Cisco has issued emergency fixes for CVE-2026-76460, a CVSS 10/10 authentication bypass in an API endpoint affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which is being exploited in the wild. Crafted API requests can bypass the web management interface, potentially grant device access and permit root-level command execution; organizations should upgrade to ISE or ISE-PIC versions 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12 and investigate affected nodes for compromise.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerInfraTrust report warns network management systems under attackCVE-2026-76460
  2. Check Point Research21st September – Threat Intelligence ReportCVE-2026-76460
  3. The Hacker News⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksCVE-2026-76460
  4. Help Net SecurityWeek in review: Cisco patches exploited email gateway 0-day, Revolut breachCVE-2026-76460
  5. Help Net SecurityUnauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)CVE-2026-76460
  6. BleepingComputerCisco warns of max severity ISE zero-day exploited in attacksCVE-2026-76460
  7. The Hacker NewsCisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active AttacksCVE-2026-76460

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store