Active Zero-Day in Cisco ISE Enables Full Authentication Bypass via Flawed API Endpoint
Cisco has issued an urgent security advisory addressing a maximum-severity zero-day vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) platforms. Tracked as CVE-2026-76460 with a CVSS score of 10.0, the flaw stems from insufficient authentication controls on an internal API endpoint. Remote, unauthenticated attackers can exploit this weakness by transmitting specially crafted requests to the vulnerable API, successfully bypassing the web-based management interface. The issue impacts all installations across releases 3.0 through 3.5 regardless of system configuration. Cisco confirmed active in-the-wild exploitation, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with an expedited remediation window. Because no software workarounds exist, administrators must deploy official patches, specifically versions 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Successful exploitation can grant adversaries command execution with root privileges, allowing them to tamper with local forensics or delete local evidence. Consequently, security teams must inspect `access.log` files on all nodes for anomalous usernames while cross-referencing external firewall and egress network logs for suspicious outbound transfers. If signs of compromise are identified, Cisco strongly advises re-imaging impacted nodes and restoring configurations from known good backups. Alongside this zero-day, Cisco rolled out fixes for several other critical vulnerabilities affecting ISE, including a secondary authentication bypass designated as CVE-2026-76423.
Commentary
Authentication bypass bugs sitting directly on identity and access management infrastructure are the absolute worst-case scenario. Cisco ISE acts as the central brain for enterprise 802.1X, TACACS+, and Zero Trust network segmentation. Gaining root access here is not just about owning the ISE box itself; it provides attackers with the keys to observe authentication flows, modify network access control policies, and pivot into otherwise isolated network enclaves. The real operational headache lies in post-exploitation cleanup. Because attackers gain root privileges, local logs on the ISE nodes cannot be trusted. If an adversary gained execution, relying solely on on-box telemetry like `access.log` to prove a negative is dangerous. In environments where this management interface was exposed, defenders must pull NetFlow, SIEM, and perimeter firewall records to look for suspicious egress connections or API interactions that never matched established admin baselines. Any organization running ISE must immediately isolate management interfaces using infrastructure access control lists (iACLs) or out-of-band management networks to stop untrusted inbound API calls before applying the patches. If anomalies appear in network or web logs, do not waste time attempting manual surgical cleanups on the host—blow away the nodes, re-image from clean ISOs, and restore sanitized backups.
The Quote to Remember
“This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”
“The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed.”