Cisco ISE Authentication Bypass CVE-2026-76460 Rated Maximum Severity

Key points

• CVE-2026-76460 is an authentication bypass in Cisco ISE with a CVSS score of 10 out of 10.
• Dark Reading reports it as a zero-day, so patch and exploitation details should be confirmed with Cisco.
• K-12 districts using ISE for network access control or identity should treat it as urgent.
• Restrict API and admin access, review logs, and apply vendor fixes as soon as available.

Dark Reading has reported a zero-day authentication bypass in Cisco Identity Services Engine tracked as CVE-2026-76460. The flaw received a maximum CVSS score of 10 out of 10, indicating severe potential impact. Cisco ISE is used to enforce identity and access policies, so a bypass could undermine trust decisions across the network.

The issue is described as affecting API endpoint authentication. That means an attacker may be able to reach protected functions without proving legitimate identity. The exact attack path, affected versions, and whether exploitation has been observed are not in the provided facts; confirm those details in Cisco's advisory.

K-12 and government organizations that run ISE for 802.1X, VPN, device administration, or guest access should assume risk until proven otherwise. If an attacker bypasses ISE, they could potentially gain network access or change policy, depending on configuration and exposure. Identity systems are high-value targets because they sit at the center of access control.

Because this is a zero-day, defenders may not have a vendor patch at the time of reporting. The priority is to reduce exposure: keep ISE management and API interfaces off the public internet, limit them to trusted admin networks, and monitor for unusual authentication or configuration activity.

Watch for Cisco's advisory, fixed software releases, and indicators of compromise. If a patch is released, test and deploy it through emergency change control. If exploitation is suspected, isolate the ISE node, preserve logs, and engage incident response.

What to do now

1. Locate Cisco's advisory for CVE-2026-76460 and identify affected ISE versions and fixed releases.
2. If a fixed release exists, schedule emergency patching after a brief compatibility test; if not, apply vendor mitigations.
3. Block public access to ISE admin and API endpoints; allow only trusted management networks and jump hosts.
4. Disable or restrict unnecessary API services and enforce MFA and least privilege for ISE administrators.
5. Review ISE and network logs for anomalous authentication, API calls, policy changes, or new admin accounts.
6. Segment ISE management interfaces from user and guest networks, and monitor outbound traffic for unexpected connections.
7. Prepare incident response: preserve logs, isolate affected nodes, and rotate credentials if compromise is suspected.

CVE references

• CVE-2026-76460

Original source

Dark Reading