Cisco released emergency fixes for CVE-2026-76460, a critical authentication-bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Rated CVSS 10.0, the flaw affects an API endpoint that lacks sufficient authentication controls, allowing unauthenticated attackers to bypass the web management interface with crafted requests and access the appliance.
Cisco says the vulnerability is being actively exploited in the wild, but has not attributed the attacks. Successful exploitation can lead to root-privileged command execution, potentially allowing attackers to conceal or delete indicators of compromise. Fixed releases are ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12. CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/
oxhak / Ox HaK
npub1sx…dz7z7
2026-09-17 07:06:04 UTC
Author Public Key
npub1sxexewvzysc3affq4yzzh7w8e3udyujap2vlj7t6lkdg5dvhp24q4dz7z7Seen on
wss://relay.damus.ioPublished at
2026-09-17 07:06:04 UTCEvent JSON
{
"id": "6c06bfc66fa6465961431a3d86bc467bf3fc5967ce8c8c4cec761059ac7e44b2",
"pubkey": "81b26cb98224311ea520a9042bf9c7cc78d2725d0a99f9797afd9a8a35970aaa",
"created_at": 1789628764,
"kind": 1,
"tags": [],
"content": "Cisco released emergency fixes for CVE-2026-76460, a critical authentication-bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Rated CVSS 10.0, the flaw affects an API endpoint that lacks sufficient authentication controls, allowing unauthenticated attackers to bypass the web management interface with crafted requests and access the appliance.\n\nCisco says the vulnerability is being actively exploited in the wild, but has not attributed the attacks. Successful exploitation can lead to root-privileged command execution, potentially allowing attackers to conceal or delete indicators of compromise. Fixed releases are ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12. CISA has added the flaw to its Known Exploited Vulnerabilities catalog.\n\nhttps://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/",
"sig": "debd574ccdd99efcc2640d211dcc67f367f278977c337a8d388d567739165d7c911d92c4c47358ea0c5b40ae8f7cc9994cb148578ed25e46905fb52da5a41040"
}