Cisco ISE API Flaw Allows Authentication Bypass, Actively Exploited

Key points

• CVE-2026-76460 impacts Cisco Identity Services Engine (ISE).
• CVSS 10.0; unauthenticated remote attackers can bypass authentication via API endpoint.
• Active exploitation confirmed; maximum severity.
• Patch or mitigate immediately to prevent network access compromise.

Cisco has issued a warning regarding a critical security hole in its Identity Services Engine (ISE) product. Tracked as CVE-2026-76460, the vulnerability carries a maximum CVSS score of 10.0. It stems from a flaw in an API endpoint that permits an unauthenticated attacker, operating remotely, to circumvent authentication mechanisms. As of September 2026, there are reports that this flaw is being actively exploited in real-world attacks.

The affected product, Cisco ISE, is widely used by enterprises and government agencies, including K-12 school districts, to manage network access control and identity-based policies. Because the vulnerability allows authentication bypass without requiring any credentials, an attacker could gain unauthorized access to the network, potentially leading to lateral movement, data theft, or disruption of critical services. The unauthenticated nature of the exploit makes it especially dangerous, as no user interaction or prior access is needed.

The maximum severity rating and confirmed active exploitation underscore the urgency for organizations relying on ISE. Remote attackers can leverage the API endpoint flaw to bypass authentication, effectively granting them a foothold into protected environments. This could compromise the integrity of identity management systems, which are foundational to zero-trust architectures. The fact that exploitation is already occurring suggests that threat actors are aware of the vulnerability and are actively scanning for exposed instances.

Administrators should watch for Cisco's official patches and mitigations. Until a fix is applied, limiting exposure of the ISE API endpoint to trusted networks and monitoring for anomalous authentication attempts are prudent. Given the active exploitation, organizations should also review logs for signs of compromise and consider network segmentation to contain any potential breach. Staying informed through Cisco's security advisories is essential, as the situation may evolve rapidly.

What to do now

1. Immediately apply any available Cisco patches or hotfixes for CVE-2026-76460.
2. If no patch exists, disable or restrict access to the vulnerable ISE API endpoint from untrusted networks.
3. Monitor ISE and network logs for unusual authentication bypass attempts or unauthorized access.
4. Segment ISE management interfaces from general network traffic to limit attack surface.
5. Enable multi-factor authentication and review access policies for any signs of compromise.
6. Conduct a forensic investigation if exploitation is suspected, and rotate credentials if needed.
7. Subscribe to Cisco security advisories for updates on patches and mitigations.

CVE references

• CVE-2026-76460

Original source

The Hacker News