If your network runs on Cisco Identity Services Engine (ISE) as its access control brain, stop scrolling. Cisco has confirmed a maximum-severity, actively exploited authentication bypass in that exact product — CVE-2026-76460, CVSS 10.0 — and CISA has already dropped it into the Known Exploited Vulnerabilities (KEV) catalog. There are no workarounds. The fix is the patch, and attackers are using this one in the wild right now.
What Cisco ISE Is, and Why It Matters
ISE is Cisco’s identity-based network access control (NAC) and zero-trust platform. When a device connects to your network, ISE checks who is connecting, profiles and fingerprints the device, verifies its security posture, and decides what access to grant — then logs all of it. It is frequently the gatekeeper that other Cisco APIs rely on for authentication and access control decisions.
That central role is exactly what makes this flaw so dangerous. If an attacker compromises ISE, they do not just own one appliance. They can disable network access controls, walk into segments they should never reach, and impersonate trusted hosts on the network.
The Vulnerability
CVE-2026-76460 is an authentication bypass caused by “insufficient authentication control on an API endpoint.” An unauthenticated, remote attacker sends a crafted request to the vulnerable API, and the appliance’s web-based management interface is bypassed entirely. No credentials. No user interaction. No legitimate access required.
The worst part: successful exploitation can give the attacker command execution with root privileges. With root on an ISE node, an intruder can hide their activity and even delete the very logs meant to catch them.
Cisco’s advisory stresses that vulnerable versions of ISE and ISE Passive Identity Connector (ISE-PIC) are affected regardless of their configuration. If you run it, you are exposed.
Affected and Fixed Versions
CVE-2026-76460 affects Cisco ISE and ISE-PIC releases 3.0 through 3.5. Cisco has published fixes in these releases:
– 3.1 Patch 12
– 3.2 Patch 11
– 3.3 Patch 12
– 3.4 Patch 7
– 3.5 Patch 4
A critical catch: ISE 3.0 has reached end of software maintenance. There is no patch for it. If you are still on 3.0, you must migrate to a supported release — staying put leaves you permanently exposed.
Cisco says it found the flaw while handling a Technical Assistance Center support case, meaning exploitation was first discovered through a real incident, not a routine audit. The company has not said who is behind the attacks or how long they have been going on.
Why It Escalated to KEV So Fast
CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on the same day Cisco disclosed it, citing confirmed active exploitation. Under Binding Operational Directive 26-04, federal agencies must patch within three days. Private sector organizations should treat that timeline as the floor, not the ceiling.
This is also not an isolated case. The same disclosure day brought 77 new CVEs, with 41 affecting ISE and 28 hitting the Secure Firewall portfolio. Related ISE flaws include CVE-2026-76423 (also CVSS 10.0) and CVE-2026-20176 (CVSS 9.9), both allowing remote code execution or command injection. If you have been deferring ISE updates, this is the moment to stop.
How to Check for Compromise
Because root access lets attackers delete on-device logs, Cisco warns against trusting the appliance alone for your incident investigation. In a distributed ISE deployment, review the logs on every node. Cisco also provides a spot-check command on the device:
admin#show logging application ise-kong/access.log | include dummyuser
Any entry containing “dummyuser” in that output is a strong indicator of malicious activity — Cisco suspects the name is used by the (not yet identified) attacker. Additionally, cross-check network and firewall logs stored outside the affected device for unexpected uploads or downloads originating from the ISE node itself. If evidence of exploitation is found, Cisco strongly recommends re-imaging the affected nodes and restoring from configuration backup.
What You Should Do Right Now
1. Patch all ISE and ISE-PIC nodes immediately. Every node in a distributed deployment needs the fix. This must be the top of your queue today.
2. Migrate off ISE 3.0. It is end-of-life with no patch. There is no mitigation — the only path is moving to a supported, fixed release.
3. Hunt for “dummyuser” in access logs on every ISE node and review external network and firewall logs for anomalous traffic to or from the appliance. Assume compromise until you can rule it out.
4. Use infrastructure ACLs as a stopgap only. Cisco notes iACLs can partially restrict management and control-plane traffic to the device as a temporary dampener, but they are not a fix and do not cover all vectors.
5. Treat the CISA KEV deadline as your own. Federal agencies have three days under BOD 26-04. Schedule any sooner and treat unpatched ISE as a critical incident.
Cisco ISE is the lock on your network’s front door, and this zero-day hands attackers the key. It is a perfect 10 on the CVSS scale, actively exploited, and unmitigated by any workaround. Patch it, hunt for signs of intrusion, and aggressively audit your NAC — because by the time an attacker owns your access control layer, they already own the network.