Cisco has confirmed active exploitation of a maximum severity flaw in Identity Services Engine (ISE), the platform hundreds of enterprises rely on to decide who and what gets network access. The bug lets a remote attacker skip authentication entirely, reach an affected device’s management interface, and in Cisco’s own words obtain command execution with root privileges, without ever presenting a credential.
A perfect 10 in the system meant to enforce access
Cisco’s advisory tracks the flaw as CVE-2026-76460, rated a maximum 10.0 on the CVSS 3.1 scale (network attack vector, low complexity, no privileges required, no user interaction, scope changed). The root cause is mundane by comparison to the impact: an API endpoint inside ISE has insufficient authentication control. An attacker who sends a crafted request to that endpoint can bypass the web based management interface outright. Cisco has released patched software for ISE and its Passive Identity Connector (ISE-PIC) and says there are no workarounds, only a mitigation: restricting management plane traffic with infrastructure access control lists (iACLs) until an upgrade is complete.
ISE is not a peripheral product in the networks that run it. It is the policy engine that decides which devices get on the network, which VLAN they land in, and which segments they can reach, the enforcement point that a Zero Trust architecture is often built around. A flaw that lets an outsider walk past that engine’s front door undermines the assumption the rest of the network design depends on: that only authenticated, policy checked traffic gets through.
Media Partner
Active exploitation, and a forensics problem Cisco admits it created
“The Cisco PSIRT is aware of active exploitation of this vulnerability,” the company’s advisory states, one of the more direct admissions Cisco has made this year about a flaw being used against customers before a patch existed. The company has not disclosed who is exploiting it, at what scale, or since when.
The advisory also flags a complication that matters more than the exploitation itself. Because a successful attack can hand an intruder root level command execution, the same access can be used to edit or erase the very access logs a defender would normally check for evidence of compromise. Cisco’s own guidance is blunt about the limits of trusting the device’s word for it: administrators should “cross-check the network logs and the firewall logs outside of the impacted device” rather than rely on what the ISE appliance itself reports, and treat unexplained uploads to external addresses or downloads from unfamiliar IPs as worth investigating even when the local logs look clean.
What it means for the security leader
This is the second Cisco appliance in a week confirmed under active exploitation with root level consequences. Cisco’s Email Gateway Can Be Rooted by One Message covered a SQL injection flaw in Cisco Secure Email Gateway that carried an almost identical warning about attackers being able to tamper with the evidence defenders are told to check. ISE repeats the pattern in a different product line, and the repetition matters more than either flaw alone: identity and access infrastructure, the layer a Zero Trust program is built around, is increasingly the layer attackers go after first rather than last, precisely because compromising it can undercut every downstream control that assumes it is trustworthy.
Security leaders running ISE should treat this less as a routine patch cycle item and more as an incident response trigger. A device that enforces network access, once bypassed, does not just expose itself; it can be used to reshape what the rest of the network believes about who is authorized to be there. GitLab Patches a Perfect-10 Flaw Under Active Probing is a reminder that a maximum severity score under active exploitation was not an isolated event this year, and organizations that treat every CVSS 10.0 alike, regardless of what the affected system actually controls, are underestimating this particular class of bug.
The scale of exposure is also worth stating plainly. ISE deployments sit at the center of network access control (NAC) programs across large enterprises, government agencies, and managed service providers, many of which use it precisely because it is trusted to make access decisions other tools rely on. A bypass here does not stay contained to one device; it can ripple into every policy decision ISE was deployed to enforce.
ISE’s role also means the blast radius extends past the network itself. Because the platform often feeds identity and posture data into downstream tools, a compromised ISE deployment can poison the inputs those tools trust, not just the network path an attacker rides in on. That is a different failure mode than a typical remote code execution bug in a standalone appliance, and it is why Cisco’s advisory treats the vulnerability as a full incident trigger rather than a routine patch, recommending re-imaging and restoration from backup for any node where exploitation is suspected rather than a simple software update.
What to do now
Cisco ISE and ISE-PIC administrators should upgrade immediately to the fixed releases (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4, depending on the version in use) rather than waiting for a routine maintenance window. Release 3.0 has reached end of software maintenance and should be migrated off, not assumed safe by inaction. Where an immediate upgrade is not possible, apply infrastructure access control lists to restrict management plane traffic as an interim measure, not a substitute for patching.
Given Cisco’s own warning about log tampering, incident responders should pull firewall and network logs independently of the ISE appliance itself before concluding a device is clean, and check access.log entries for the suspicious username pattern the advisory describes. Any organization that finds evidence of exploitation should assume local logs may be incomplete and plan remediation, including re-imaging affected nodes, accordingly.
Source: Cisco
