Critical Cisco ISE Zero-Day Scores Perfect CVSS Rating, Exposes API Authentication Flaw

Cisco's Identity Services Engine (ISE) is facing a severe security issue after a newly disclosed zero‑day vulnerability, cataloged as CVE‑2026‑76460, earned a perfect 10.0 on the CVSS scale, indicating the highest possible risk to affected deployments.

The flaw resides in an API endpoint that fails to enforce proper authentication, effectively allowing an unauthenticated actor to invoke privileged functions within ISE. By exploiting the weakness, an attacker can bypass the platform's normal access‑control checks, potentially gaining administrative capabilities without presenting valid credentials.

ISE is a cornerstone of many enterprise networks, providing centralized authentication, authorization, and accounting services for wired, wireless, and VPN connections. A breach of this nature could let malicious actors manipulate network policies, create rogue user accounts, or harvest sensitive authentication data, thereby facilitating lateral movement across the corporate environment.

The vulnerability came to light through a security researcher who alerted Cisco before the details were made public. Dark Reading was the first outlet to report on the issue, noting the rapid escalation from discovery to disclosure. Cisco responded by issuing an emergency advisory and releasing a patch that addresses the faulty API logic, urging customers to apply the update without delay.

Security teams are being counseled to prioritize the patch, verify that all ISE instances are running the latest firmware, and review audit logs for any signs of unauthorized API calls. In parallel, best‑practice recommendations include tightening network segmentation, employing multi‑factor authentication for administrative access, and conducting regular penetration tests focused on API surfaces.

The episode underscores a broader trend in which attackers target the increasingly programmable interfaces of networking equipment. As organizations lean on APIs to automate policy enforcement and integrate with third‑party tools, ensuring robust authentication and authorization mechanisms becomes essential to prevent similar high‑impact exploits in the future.