#auth-bypass

Active Zero-Day in Cisco ISE Enables Full Authentication Bypass via Flawed API Endpoint

Cisco has issued an urgent security advisory addressing a maximum-severity zero-day vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) platforms. Tracked as CVE-2026-76460 with a CVSS score of 10.0, the flaw stems from insufficient authentication controls on an internal API endpoint. Remote, unauthenticated attackers can exploit this weakness by transmitting specially crafted requests to the vulnerable API, successfully bypassing the web-based management interface. The issue impacts all installations across releases 3.0 through 3.5 regardless of system configuration. Cisco confirmed active in-the-wild exploitation, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with an expedited remediation window. Because no software workarounds exist, administrators must deploy official patches, specifically versions 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Successful exploitation can grant adversaries command execution with root privileges, allowing them to tamper with local forensics or delete local evidence. Consequently, security teams must inspect `access.log` files on all nodes for anomalous usernames while cross-referencing external firewall and egress network logs for suspicious outbound transfers. If signs of compromise are identified, Cisco strongly advises re-imaging impacted nodes and restoring configurations from known good backups. Alongside this zero-day, Cisco rolled out fixes for several other critical vulnerabilities affecting ISE, including a secondary authentication bypass designated as CVE-2026-76423.