Summary
- CVE-2026-76460 is a maximum-severity (CVSS 10) zero-day in Cisco Identity Services Engine, actively exploited before a patch was available.
- The vulnerability resides in an ISE API and allows a remote attacker to bypass authentication and gain full root control of the device.
- Root access on an ISE appliance lets an attacker modify network access policy, extract credentials, delete logs, and move laterally across all network segments ISE manages.
- CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue; no workarounds exist — patching is the only remediation.
- This is the second actively exploited Cisco zero-day disclosed within 48 hours, though the two vulnerabilities affect different products and are technically unrelated.
Back-to-Back Zero-Days From Cisco
Cisco has disclosed a second actively exploited zero-day vulnerability in as many days. Coming just 48 hours after the disclosure of CVE-2026-76461, a zero-day in Cisco Secure Email Gateway, the latest vulnerability — CVE-2026-76460 — affects Cisco Identity Services Engine and carries the highest possible severity rating. Cisco discovered the flaw during a technical support case, which suggests real-world exploitation was already underway before the vendor had a patch ready.
What the Vulnerability Does
The defect sits in an API within Cisco Identity Services Engine. A remote attacker can exploit it to bypass authentication entirely and gain full root-level control of the affected appliance. No credentials are required. The practical consequences of that access are significant: ISE is the product that enforces network access policy across an organisation’s environment, meaning whoever controls ISE effectively controls the gate.
Why ISE Is a High-Value Target
Landon Rice, a senior exploit developer at VulnCheck, explained the downstream risk clearly. Root access on an ISE appliance allows an attacker to modify network access policy, extract stored credentials, delete logs to cover tracks, and move laterally into every network segment ISE controls. That combination — policy manipulation, credential theft, and log destruction — represents a serious threat to both detection capability and network integrity. Rice also noted that Cisco ISE vulnerabilities have been a recurring target. Multiple critical flaws in the product have been exploited since June 2025, including CVE-2025-20337 and CVE-2025-20281, both rated 10 out of 10 on the CVSS scale, the same rating assigned to CVE-2026-76460.
No Workarounds, No Attribution
Cisco has stated plainly that no workarounds exist for this vulnerability. Upgrading to fixed software is the only available remediation. The vendor has also published indicators of compromise to assist customers in hunting for exploitation attempts within their environments. Researchers have not attributed the observed attacks to any specific threat group or nation-state actor. Cisco has not disclosed how many organisations have been compromised to date, nor when the first exploitation occurred.
Consecutive CVE Numbers, No Technical Connection
The proximity of the two CVE identifiers — 76460 and 76461 — is coincidental. Rice confirmed the two vulnerabilities affect different products and different vulnerability classes, with no technical relationship between them. A Cisco spokesperson reinforced that point, noting CVEs are assigned on a first-come, first-served basis and that consecutive numbering reflects assignment order only. The two vulnerabilities affect entirely different codebases.
Regulatory and Catalogue Implications
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-76460 to its Known Exploited Vulnerabilities catalogue shortly after Cisco’s disclosure. For organisations subject to CISA’s Binding Operational Directive 22-01, or those using the KEV catalogue as a patching prioritisation signal, this triggers a mandatory remediation timeline. Australian organisations operating under comparable frameworks, or those aligned to the Essential Eight, should treat this as a high-priority patching event given the critical rating and confirmed active exploitation.
Why it matters
Cisco ISE sits at the heart of network access control in many enterprise environments. A compromised ISE appliance does not simply represent one affected device — it gives an attacker the ability to rewrite the rules governing who and what can access the network, extract the credentials ISE has collected, and erase the evidence of their presence. For CISOs, the risk is not contained to the appliance itself; it extends to every segment ISE manages. The absence of any workaround means there is no interim mitigation to buy time — the patch is the only option. The fact that Cisco ISE has now seen multiple critical, actively exploited vulnerabilities within a single calendar year suggests adversaries have identified this product category as a reliable entry point into large enterprise networks.
What to do now
- Apply Cisco’s available fixed software for CVE-2026-76460 in Cisco Identity Services Engine immediately — no workarounds exist.
- Review Cisco’s published indicators of compromise and use them to hunt for exploitation attempts in your ISE environment.
- If subject to CISA’s Binding Operational Directive 22-01 or an equivalent framework, initiate remediation tracking for this KEV catalogue entry.
- Assess whether CVE-2025-20337 and CVE-2025-20281, earlier critical ISE vulnerabilities exploited since June 2025, have also been patched in your environment.
- Treat the Cisco Secure Email Gateway zero-day (CVE-2026-76461) as a separate, parallel patching priority — it affects a different product and codebase.
