On 16–17 September 2026, Cisco disclosed and patched a maximum-severity flaw in Identity Services Engine, the identity and network-access-control platform many organisations use to decide who and what is allowed onto their network. CVE-2026-76460 scores a perfect 10.0 on CVSS, requires no credentials, and Cisco has confirmed it is already being actively exploited. If your team runs ISE to manage network access, this is a same-day patch, not a scheduled one.
What the flaw actually does
The vulnerability comes from insufficient authentication control on an ISE API endpoint. An unauthenticated attacker can send a specially crafted request to that endpoint and bypass the web-based management interface entirely — no valid administrator credentials required. Cisco says successful exploitation can go further than simple access: it can deliver command execution as root, meaning an attacker doesn't just get into the admin panel, they can potentially alter the system outright and remove or conceal evidence that they were ever there.
For context on why that specific detail matters: ISE is the system many organisations trust to decide which devices and users are allowed onto their network in the first place. A root-level compromise of the system that grants network access is close to the worst-case outcome for that category of product — it is not just one more admin panel to lock down.
Who is affected and what fixes it
The flaw affects Cisco ISE releases 3.1 through 3.51. Fixed patches are available per release: 3.1 in Patch 12, 3.2 in Patch 11, 3.3 in Patch 12, 3.4 in Patch 7, and 3.51 in Patch 4. If you run ISE, check your exact release and patch level against that list — the fix version differs by release line, so "we're patched" on one deployment doesn't tell you anything about another running a different ISE version.
The timeline
Cisco discovered the issue while resolving a customer support case, disclosed it publicly on 17 September alongside the patches, and CISA added it to its Known Exploited Vulnerabilities catalogue the day before, on 16 September — evidence of active exploitation was already in hand at disclosure time. CISA set a remediation deadline of 19 September for US federal civilian agencies, a two-day window from disclosure to deadline. Cisco has confirmed exploitation is happening but has not attributed it to a specific actor.
What to actually do
First, patch. Match your ISE release to the patch list above and apply it — this is the only complete fix, and given confirmed active exploitation, "we'll get to it this sprint" is not a defensible position for an internet-reachable ISE deployment.
Second, check whether you were already hit before you patch. Cisco's own guidance points to reviewing the ISE access log for suspicious usernames using a logging command against the ise-kong access log specifically. If your ISE deployment is distributed across multiple nodes, check all of them — a compromise on one node in a distributed deployment does not necessarily show up on the others.
Third, if you find evidence of exploitation, treat it as a full compromise rather than a single bad login: Cisco's own advisory notes that root-level access lets an attacker erase the very logs you would use to detect them, so the safer response to confirmed exploitation is re-imaging the affected node and restoring from a known-good configuration backup, not just patching in place.
Fourth, if you cannot patch immediately for change-control reasons, Cisco's interim mitigation is to apply infrastructure access control lists that restrict management-plane traffic to ISE — that reduces exposure but is not a substitute for the patch, and should be treated as a stopgap measured in hours, not weeks.
The bottom line
CVE-2026-76460 is a maximum-severity, unauthenticated, root-level compromise of Cisco ISE, already under active exploitation, with per-release patches available now. If you run ISE anywhere in your network, match your release to Cisco's patch list today, check your access logs for the indicators Cisco published, and treat any positive finding as a full compromise requiring re-imaging rather than a quiet patch-and-move-on.