Cisco ISE CVE-2026-76460 is under active exploitation

Cisco says attackers are actively exploiting CVE-2026-76460, a CVSS 10.0 authentication-bypass vulnerability in Identity Services Engine (ISE). The flaw lets an unauthenticated remote attacker bypass authentication through an API endpoint and reach the web-based management interface. Cisco has released fixes, says there is no workaround, and recommends checking logs for evidence of compromise.

What CVE-2026-76460 exposes

The vulnerability is an insufficient authentication-control bug in an ISE API. A crafted request can bypass the normal authentication boundary. Cisco warns that successful exploitation may lead to root-level command execution and that threat actors could remove or hide evidence on the affected appliance.

This is an infrastructure-management issue, not a client-side browser bug. Organizations running ISE should identify every node with the affected release lines, including distributed deployments, and treat externally reachable management paths as urgent exposure.

Cisco’s patch and detection guidance

Cisco’s advisory lists fixed software for supported release lines and says administrators should upgrade to the first fixed release rather than rely on temporary mitigations. There is no workaround that replaces the update. Cisco does describe infrastructure access-control lists as a mitigation that can restrict management and control-plane traffic while patching is arranged.

The advisory specifically tells administrators to review access.log on every node for suspicious usernames, including entries that indicate attempted API abuse. Cisco also recommends checking network and firewall logs outside the device for unexpected uploads to external IP addresses or downloads from malicious addresses, because local indicators may be altered after a successful compromise.

The exploitation status changes the response window

Cisco’s own PSIRT marks the vulnerability as actively exploited. TechRadar independently reports the same exploitation status and the U.S. CISA Known Exploited Vulnerabilities listing, making this more than a routine monthly patch notice. The relevant question for defenders is whether ISE is present, exposed, and patched—not whether an exploit has already been observed in their own logs.

Teams should inventory ISE and ISE-PIC nodes, compare versions with Cisco’s fixed-release table, apply the update, restrict access with infrastructure ACLs during the change window, and preserve external network logs for incident review. If suspicious usernames or unexplained outbound transfers appear, handle the event as a possible compromise and follow the organization’s incident-response process.

Evidence and scope

Cisco is the primary source for the vulnerability mechanics, active-exploitation statement, mitigations, and remediation guidance. TechRadar provides independent corroboration and reports the CISA KEV context. This article does not infer compromise from the presence of an affected version alone; administrators need local log and network evidence to determine impact.