Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
Summary: Cisco warned of CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine and ISE-PIC caused by insufficient authentication control on an API endpoint, and said it is aware of active exploitation. CISA added the flaw to its KEV catalog on September 16, 2026, with a September 19, 2026 patch deadline for FCEB agencies, and Cisco said exploitation can yield root-level command execution with no workarounds available.
Bottom line: Successful exploitation gives attackers root, which means the log evidence you would use to confirm a breach can be removed or hidden by the attacker - and the three-day federal patch window signals how little time is assumed to exist.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-76460CVE-2026-76461
- Related
- CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability Known Exploited Vulnerabilities · Sep 16, 2026CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability Known Exploited Vulnerabilities · Sep 14, 2026