Cisco has released emergency patches for CVE-2026-76460, an actively exploited authentication-bypass vulnerability affecting Cisco Identity Services Engine and Cisco ISE Passive Identity Connector. Crafted requests to a management API endpoint can bypass the normal web interface and give an unauthenticated attacker root-level privileges. CISA has added the maximum-severity flaw to its Known Exploited Vulnerabilities catalog.
Why This Vulnerability Is Critical
Cisco ISE supports enterprise network access control and policy enforcement, so compromise can affect a particularly sensitive part of the infrastructure. CVE-2026-76460 affects Cisco ISE and ISE-PIC in all configurations.
Exploitation does not require authentication.
Attackers can bypass the normal web-based management interface through an API endpoint.
Successful exploitation provides root-level privileges.
Root access could allow an attacker to alter the system or remove local evidence of compromise.
Fixed Cisco ISE Releases
The required update depends on the major Cisco ISE or ISE-PIC release in use. Cisco fixed the vulnerability in the following versions:
3.1 Patch 12
3.2 Patch 11
3.3 Patch 12
3.4 Patch 7
3.5 Patch 4
Organizations should first identify every affected node and its current software release, then verify that the appropriate patch has been applied. Internet-facing or broadly reachable management interfaces warrant particular urgency because exploitation has already been confirmed in the wild.
Compromise Checks and Recovery
Cisco advises administrators to examine the access.log file for suspicious usernames. Because an attacker with root privileges could delete or manipulate local logs, defenders should also review upstream network and firewall logs for suspicious uploads, downloads, or connections involving unauthorized IP addresses.
If malicious activity is suspected, Cisco strongly recommends re-imaging affected nodes and restoring configuration backups where needed. Infrastructure access control lists should also be used to restrict which systems can send management and control traffic to the affected devices.
A Wider Cisco ISE Security Update
CVE-2026-76460 is one of numerous issues addressed after Cisco reviewed the ISE and ISE-PIC platforms. The resulting releases fix 21 critical vulnerabilities, including remote-code-execution and related API flaws, as well as three high-severity and 18 medium-severity vulnerabilities.
This was also Cisco's second emergency zero-day patch during the week, following a critical Secure Email Gateway vulnerability. Separately, Cisco issued fixes for critical- and medium-severity flaws in Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software.
How ConnectMyAssets Helps
ConnectMyAssets helps infrastructure teams turn an urgent advisory into a controlled remediation process across managed Cisco equipment and the surrounding multi-vendor network.
Dynamic CMDB uses automatic discovery to identify managed assets and maintain current inventory data, helping teams locate potentially affected systems.
CVE Tracking associates vulnerability exposure with individual assets so teams can prioritize CVE-2026-76460 remediation and follow affected nodes through the response.
Backup & History maintains configuration versions with SHA256 verification, supporting recovery workflows when a device must be re-imaged and restored.
Firewall Management helps teams review cross-vendor access policies and identify shadowed or redundant rules while tightening management-plane reachability.
Compliance Engine provides weighted scoring against frameworks including NIS2, ISO 27001, PCI-DSS, CISA, and NIST, helping document remediation posture.
Automation & ZTP can standardize approved changes across managed equipment when workflows have been validated for the relevant devices and releases.
ConnectMyAssets runs as a hardened on-prem OVA, so asset, vulnerability, configuration, and compliance data remain within the organization's environment.
Source: Network World
