Overview
- Cisco confirmed an authentication‑bypass zero‑day in Identity Services Engine called CVE‑2026‑76460 that it says has been exploited in the wild and released fixed ISE and ISE‑PIC software builds.
- The vulnerability lets a remote, unauthenticated attacker call a vulnerable API to bypass the web management interface and gain command execution as root, which can let them change access policies and remove local evidence.
- The U.S. Cybersecurity and Infrastructure Security Agency added CVE‑2026‑76460 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate within three days, setting a Sept. 19 deadline for fixes or mitigation.
- Cisco published indicators of compromise and hunting guidance and urged customers to apply patches immediately, review access.log and external network logs for suspicious activity, re‑image suspected nodes, and rotate credentials and keys.
- The ISE zero‑day is part of a larger Cisco update that fixed dozens of critical flaws across FMC, Nexus Dashboard and Secure Email Gateway, reflecting a pattern of attackers targeting management and perimeter appliances and increasing urgency for broad patching.