Cisco ISE CVSS 10.0 Flaw Disclosed, Fix Released Amid Confirmed Exploitation

Cisco has disclosed a critical authentication bypass flaw in Identity Services Engine, its network access control platform. The flaw is tracked as CVE-2026-76460 and has been assigned the maximum score of 10.0 under the Common Vulnerability Scoring System (CVSS). It can be exploited remotely without authentication, and successful exploitation leads to command execution with root privileges. The company said active exploitation has been confirmed and is urging users to apply the fixed releases immediately. According to reporting by Carly Page of The Register, details were reported on September 17, U.S. time.

The affected products are Identity Services Engine and ISE Passive Identity Connector. Both are positioned as core systems responsible for access authentication and policy enforcement in enterprise networks. An authentication control weakness existed in an API behind the administrative interface. An attacker can bypass administrative authentication by sending a crafted request. No credentials or user interaction are required, and vulnerable versions are said to be affected regardless of configuration.

The company’s Product Security Incident Response Team said it is aware of active exploitation. The U.S. Cybersecurity and Infrastructure Security Agency has also added the flaw to its Known Exploited Vulnerabilities catalog. This is a situation in which the very devices meant to guard the entrance to managed networks are themselves taken over. There is also a noted risk that evidence may be erased after compromise. It is a structure in which any delay in initial response directly leads to expanded damage.

Technical Mechanism and Conditions Behind the

Authentication Bypass

The problem with this flaw lies in the authentication controls for an API provided by ISE. Operations that should only be permitted via the administrative interface could be executed through direct requests. According to Cisco, authentication checks for a specific API were insufficient. If an attacker can reach the device over the network, commands can be injected without credentials. There is no need to induce any action by the user.

The impact is not limited to information disclosure. After bypassing authentication, an attacker can reach administrative functions and achieve command execution as root on the underlying OS. Seizing root privileges enables alteration or deletion of logs. There is a risk that compromise cannot be determined from on-device logs alone. Correlation with communication logs stored externally is essential.

The fact that no configuration-based workaround can be expected also adds weight. Cisco said vulnerable versions of ISE and ISE-PIC are affected regardless of configuration. Whether a distributed deployment is used or how strict policies are does not provide defense. If the exposed API is exposed to management networks or the control plane, the danger increases. Measures are required to cut off reachability to the platform itself.

Cisco “strongly recommends” reimaging affected nodes and restoring their configurations from backup if necessary.

The above is the company’s strong recommendation regarding response when signs of compromise are found. Recovery procedures based on reimaging and restoration were presented. Restoring trust in a device once root has been seized is not easy. Work will arise on both log review and rebuilding.

Series of Critical Flaws and Response History

This disclosure is not an isolated incident. Just days earlier, a critical flaw CVE-2026-76461 in email-related appliances had been disclosed. The targets were Secure Email Gateway and Secure Email and Web Manager. With a CVSS score of 9.8, it also led to seizure of root privileges. The company had mentioned the possibility of attackers hiding traces after intrusion.

Administrators who had been busy with update work for email defense appliances were then forced to address ISE in succession. Both share the common trait of leading to remote root access without authentication. Devices that are central to defense have been targeted in succession. The load on operational teams is concentrated in a short period. Prioritization and rapid change management are being tested.

Cisco also released bundled updates for multiple IOS XR-related flaws in September. Fix work is overlapping across its core product families. As reported in Microsoft Defender Privilege Escalation Vulnerability “RoguePlanet” Disclosed, which covered a flaw in a defensive mechanism itself, this case also shakes the root of trust. Flaws in defense products have broader repercussions than flaws in ordinary applications. This is because compromise of a single device can lead to collapse of the authentication infrastructure for the entire network. The consecutive disclosures are seen as straining maintenance systems across the supply chain.

The disclosure process also has distinctive features. Cisco acknowledged active exploitation and urged immediate application of the fixed releases. Registration in the U.S. authorities’ catalog also proceeded quickly. The time gap between public disclosure and exploitation is extremely small. Administrators need to respond without waiting for detailed analysis. Operations based on after-the-fact response have entered a stage where they are no longer sufficient.

Practical Response for Log Review and Recovery

Cisco calls for updating to fixed releases as the permanent countermeasure. It stated explicitly that no workaround exists. As a temporary mitigation, use of Access Control Lists was presented. Management and control-plane traffic are the targets. It is a method to limit reach to affected devices and narrow the exposure surface.

There is no permanent solution other than updating. In distributed deployments, all nodes need to be upgraded. If only some are updated, trust in the entire authentication infrastructure will not be restored. Maintenance windows must be secured while backing up configurations in parallel. Prior verification of recovery procedures will determine work time.

Procedures for confirming compromise were also specifically presented. Check connection logs on each node for suspicious usernames. Examine network and firewall logs stored outside the devices. Traces of unexpected inbound and outbound communications serve as clues. Because on-device logs may have been altered, external logs are emphasized.

Response when evidence is found is heavy. Cisco strongly recommended reimaging affected nodes. It is a procedure to restore configurations from backup as necessary. Simply applying the fix does not restore trust. Plans based on reimaging and rebuilding are required.

On the operational side, separation of management networks is again called into question. The basic design is not to make administrative APIs reachable from general user networks. Access control lists and firewall policies need to be inventoried. Centralizing privileged access logs externally is also effective. This incident is assessed as prompting a review of both design and operations.

Editorial Opinion

On short-term impact. Over the next 3 to 6 months, emergency updates are expected to concentrate among organizations using ISE. Overlapping with response for email appliances, a shortage of maintenance personnel may become apparent. With external log review and reimaging work added, operational costs are expected to increase temporarily. Attackers are seen intensifying automated scanning, and screening of exposed devices is assessed to progress.

On the long-term perspective. In 1 to 3 years, separation of authentication infrastructure and preservation of external logs are expected to become standard requirements. Operations to continuously monitor the exposure of management APIs are assessed to spread. Robustness of defense products themselves will be added to procurement conditions, and upgrade capability will become a selection criterion. The vendor’s consecutive disclosures are assessed as testing the speed of trust rebuilding.

Questions from the editorial team. How far reachability to management infrastructure can be narrowed is considered to be in question. Assuming internal logs can be altered, how to retain external evidence is the issue. How many organizations have restoration procedures that allow an immediate decision to reimage. How the balance between centralized management of defense devices and distributed risk should be struck.

References

• “Cisco drops another exploited zero-day, this time a perfect 10”, by Carly Page — The Register, 2026-09-17T12:40:00.000Z (ARR)
• Source URL: https://www.theregister.com/security/2026/09/17/cisco-drops-another-exploited-zero-day-this-time-a-perfect-10/5297180