Cisco Urges Immediate Patch for Actively Exploited ISE Zero‑Day Vulnerability

Cisco Systems has released an emergency update to address a critical vulnerability in its Identity Services Engine (ISE) platform, identified as CVE‑2026‑76460. The flaw permits unauthenticated attackers to bypass API authentication, granting them unrestricted access to network policy controls. Security researchers confirm the exploit is being used in the wild, prompting Cisco to label it a maximum‑severity, zero‑day threat.

ISE is a cornerstone of many enterprise and government networks, providing centralized authentication, authorization, and accounting services for wired, wireless, and VPN connections. By compromising the API layer, threat actors can manipulate user identities, alter access policies, and potentially pivot to other systems on the same network. The vulnerability’s active exploitation underscores the risk of leaving the component unpatched, especially in environments that rely heavily on automated policy enforcement.

Cisco’s response includes a software patch that closes the authentication bypass. The company advises that no temporary workarounds exist; disabling the affected ISE services or applying the patch are the only viable mitigations. In its advisory, Cisco’s Product Security Incident Response Team (PSIRT) emphasized the urgency, noting that the flaw could be leveraged to achieve full network compromise with minimal effort.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the ISE vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, a list that highlights flaws actively targeted by malicious actors. Federal agencies are now required to either install the Cisco update or disable the ISE component no later than September 19. Non‑compliance could result in heightened oversight and potential penalties, as the directive aligns with broader government efforts to harden critical infrastructure against cyber threats.

Industry analysts say the incident reinforces the importance of rapid patch management and continuous monitoring of network‑access solutions. Organizations are urged to verify that the latest ISE firmware is deployed across all instances, review audit logs for any anomalous API activity, and incorporate the patch into their vulnerability‑remediation roadmaps. As the threat landscape evolves, the ISE case serves as a reminder that even well‑established security products can harbor severe flaws that demand swift, coordinated action.