Cisco Warns of Active Exploitation of Critical ISE Flaw

Cisco has warned customers of the active exploitation of a maximum severity flaw affecting its Cisco Identity Services Engine (ISE) product.

The flaw, CVE-2026-76460, is due to insufficient control on an API endpoint. It has a maximum CVSS rating of 10.0.

“An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface,” Cisco wrote in its update dated September 16.

The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.

The tech giant has released software updates to address the flaw and urged customers to upgrade to prevent exploitation.

There are no workarounds that address the vulnerability. However, customers can use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device to prevent remote exploitation prior to applying the software update.

Following Cisco’s public disclosure, the US Cybersecurity and Infrastructure Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog. This requires Federal Civilian Executive Branch (FCEB) agencies to prioritize applying a patch for the vulnerability.

Cisco ISE is a centralized security policy management platform that controls network access across wired, wireless and VPN connections.

Cisco Customers Told to Check for Signs of Exploitation

Cisco also recommended that ISE customers look for indicators of attempted exploitation of the vulnerability.

Security teams should review the access.log and look for suspicious usernames, with Cisco providing an example of how this may look.

“The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed,” Cisco said.

The firm also warned that successful exploitation could result in attackers obtaining command execution with root privilege – a level of access that could allow them to remove or hide evidence of exploitation and indicators of compromise.

Therefore, Cisco strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity. This includes unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.

The Cisco update is part of a group of advisories issued by the company, which highlights a range of other vulnerabilities of varying degrees of severity and their available fixes.