Cisco Warns of Active Exploitation of Critical ISE Flaw

Cisco has warned customers of the active exploitation of a maximum severity flaw affecting its Cisco Identity Services Engine (ISE) product.

The flaw, CVE-2026-76460 , is due to insufficient control on an API endpoint. It has a maximum CVSS rating of 10.0.

“An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface,” Cisco wrote in its update dated September 16.

The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.

The tech giant has released software updates to address the flaw and urged customers to upgrade to prevent exploitation.

There are no workarounds that address the vulnerability. However, customers can use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device to prevent remote exploitation prior to applying the software update.

Following Cisco’s public disclosure, the US Cybersecurity and Infrastructure Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog. This requires Federal Civilian Executive Branch (FCEB) agencies to prioritize applying a patch for the vulnerability.

Cisco ISE is a centralized security policy management platform that controls network access across wired, wireless and VPN connections.

Cisco Customers Told to Check for Signs of Exploitation

Cisco also recommended that ISE customers look for indicators of attempted exploitation of the vulnerability.

Security teams should review the access.log and look for suspicious usernames, with Cisco providing an example of how this may look.

“The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed,” Cisco said.

The firm also warned that successful exploitation could result in attackers obtaining command execution with root privilege – a level of access that could allow them to remove or hide evidence of exploitation and indicators of compromise.

Therefore, Cisco strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity. This includes unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.

The Cisco update is part of a group of advisories issued by the company, which highlights a range of other vulnerabilities of varying degrees of severity and their available fixes.

Cisco Warns of Critical Vulnerability in IOS XE Software News 17 October 2023

Cisco Warns of Critical Vulnerability in IOS XE Software

Australia Warns of Active Exploitation of Critical TeamCity Server Flaw News 25 August 2026

Australia Warns of Active Exploitation of Critical TeamCity Server Flaw

Cisco Discloses Critical RCE Flaw in Firewall Management Software News 15 August 2025

Cisco Discloses Critical RCE Flaw in Firewall Management Software

Cisco Fixes Critical Vulnerability in Meeting Management News 23 January 2025

Cisco Fixes Critical Vulnerability in Meeting Management

US Cyber Command: Patch Critical Atlassian Bug Now News 6 September 2021

US Cyber Command: Patch Critical Atlassian Bug Now

What’s Hot on Infosecurity Magazine?

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

Microsoft Releases Emergency Patch to Fix RDS Vulnerability

Most Fraudulent Hires Receive Credentials Before Detection

Revolut Confirms Data Breach Through Fake Government Requests

Most Firms Unable to Recover Quickly from Ransomware

Cyber-Attacks Cost Organizations $52,000 on Average

Anthropic Reveals Yet Another Cybersecurity Incident

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors

Defense Cyber Spending Set to Surge Amid Rising Attacks on Military Systems

CRA Reporting Rules Take Effect: How to Ensure Your Organization is Ready

A CISO's Lessons in Ransomware Response and Recovery After a Real-World LockBit Attack

Frontier AI: How Cyber Defenders Can Harness the Defender’s Window

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser

How To Enhance Security Operations with AI-Powered Defenses

How to Manage Enterprise Cyber Resilience in the Age of AI

Financial Services Cyber Resilience: Stress Testing Third Parties Before Attackers Do

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust