Cisco has disclosed a critical zero-day vulnerability, CVE-2026-76460, affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw carries a CVSS score of high and is being actively exploited in the wild. It results from insufficient authentication controls on an API endpoint and can be exploited remotely without authentication by sending specially crafted requests. Successful exploitation can bypass the web-based management interface and potentially provide attackers with root-level command execution, giving them extensive control over affected ISE systems.

Cisco ISE is widely deployed for network access control, user and device authentication, security policy enforcement, and asset visibility, making the vulnerability particularly significant for enterprise environments. An attacker who gains root access could modify configurations, steal credentials, deploy malicious tools, establish persistence, and use the compromised appliance as a staging point for lateral movement. The vulnerability affects Cisco ISE and ISE-PIC regardless of configuration, including ISE 3.0, which is already end-of-life for software maintenance. Cisco has released fixes in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.

Cisco confirmed that no workaround is available, making upgrading to a fixed release the primary remediation. Organizations should identify all deployed ISE/ISE-PIC nodes and upgrade them to the appropriate patched version as soon as possible. If immediate patching is not possible, administrators should use infrastructure access control lists (iACLs) to restrict management and control-plane traffic and ensure that only essential, trusted systems can communicate with ISE management interfaces. These controls should be treated as temporary mitigation rather than a replacement for applying the security update.

Security teams should also investigate all ISE nodes for potential exploitation, particularly by reviewing access.log for suspicious usernames and unexpected API activity, using commands such as show logging application ise-kong/access.log | include dummyuser. Additional debug logs and support bundles can provide further API-gateway evidence, although Cisco warns that root-level attackers may delete or alter forensic artifacts. Teams should therefore correlate ISE activity with firewall and network logs, looking for unusual outbound connections, unexpected uploads/downloads, or communications with external IP addresses. If compromise is confirmed or strongly suspected, affected nodes should be reimaged and restored from known-good backups, while preserving available evidence for investigation.