Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460)

Two days after it warned customers an actively exploited email gateway zero-day , Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE).

Cisco ISE is an identity-based network access control and policy platform.

It checks connecting users’ identity, profiles devices and checks their security posture, grants users the right type of access, and logs it all.

“[CVE-2026-76460] is due to insufficient authentication control on an API endpoint,” Cisco explained .

As per usual, Cisco did not disclose details the attacks they observed, but has provided indicators of compromise.

“To confirm any attempted exploitation of this vulnerability, review the access.log and look for suspicious usernames. The presence of any entry in the output may indicate malicious activity,” the vendor noted.

“This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed.”

And, since attackers may use the obtained access to delete the solution’s logs, defenders should also “cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”

CVE-2026-76460 affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), releases 3.0 through 3.5. Customers have been advised to upgrade to the first fixed release – 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 – as there are no workarounds that address this vulnerability.

Cisco has also fixed a bucketload of additional Cisco ISE and ISE-PIC vulnerabilities, most reported by outside vulnerability researchers, but some discovered by Cisco during internal security testing with the help of frontier AI models.

Cisco ISE Software Release 3.0 is no longer maintained, and Releases 3.1 and 3.2 get only the critical fixes, so customers are advised to migrate to the supported releases: 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4.

The AI security question leaders should be asking instead

AI is adding to the review load on open-source projects, many of them thinly funded

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

Fake AI trading agent steals crypto wallet passwords

The AI security question leaders should be asking instead

A flat cybersecurity budget doesn’t have to mean weaker coverage

AI is adding to the review load on open-source projects, many of them thinly funded

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)