Cisco Fixes a Critical 0-Day in Identity Services Engine Already Being Used in Attacks

Cisco has released emergency updates for its Identity Services Engine (ISE) platform and its ISE Passive Identity Connector (ISE-PIC) component, closing a maximum-severity vulnerability. According to the vendor, the flaw is already being actively exploited by attackers.

ISE is a centralized access-policy management platform: administrators use it to control endpoints, users and connections to network resources, including when building a Zero Trust architecture. That is precisely why compromising such a system is especially dangerous.

What the vulnerability is about

The flaw, assigned the identifier CVE-2026-76460, is caused by insufficient authentication verification on one of the API endpoints. A remote attacker can send a specially crafted request and bypass the web-based management interface, gaining unauthorized access to the device — regardless of its configuration. No workaround exists, so the only means of protection is installing the patched version of the software.

Cisco notes that its incident response team (PSIRT) has recorded instances of active exploitation. Fixes are available for the 3.1–3.5 branches: the corresponding patches are listed in the advisory (for example, 3.4 Patch 7 and 3.5 Patch 4).

What administrators should do

The vendor has published indicators of compromise and recommends checking the access.log files on all nodes for suspicious usernames. If traces of malicious activity are found, Cisco “strongly” advises reinstalling the nodes from scratch and restoring them from backups. It is also worth reviewing firewall and network logs: having obtained command execution with root privileges, attackers can erase traces of their presence, including data uploads to external addresses.

The CISA agency has added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to remediate it within three days — an unusually strict deadline.

At the same time, Cisco closed another critical authentication-bypass vulnerability (CVE-2026-76423) and five other serious issues in ISE and ISE-PIC, though their exploitation has not yet been observed.

This is not the first time ISE has come under attack: in July 2025, attackers exploited another maximum-severity 0-day (CVE-2025-20337) for remote code execution and deployed the IdentityAuditAction web shell, disguised as a legitimate component. Over the past five years, CISA has flagged 99 vulnerabilities in Cisco products as actively exploited, seven of which were used in ransomware attacks.

Source: Bleeping Computer