Cisco ISE Authentication Bypass Actively Exploited; No CVE in Report

Key points

• Cisco ISE authentication bypass is reported as actively exploited.
• No CVE identifier or vendor advisory link was included in the provided facts.
• The issue follows another recent Cisco zero-day that forced urgent patching.
• K-12 and government admins should verify ISE exposure and apply Cisco guidance.
• Monitor authentication and admin logs for signs of unauthorized access.

The Register reports that Cisco ISE is affected by an authentication bypass that attackers are already using. The provided information does not include a CVE identifier or vendor advisory link, so defenders should verify directly with Cisco. The report says it follows another Cisco zero-day that recently required urgent patching.

ISE is central to identity and network access control. Organizations using it for 802.1X, VPN, device administration, or policy enforcement could be exposed. A bypass could allow an attacker to appear authenticated, reach protected network segments, or change access decisions. In K-12 and government environments, that can affect student, staff, and administrative systems.

The timing matters. Two Cisco zero-days close together can strain patch cycles and create confusion about which systems are fixed. The absence of a CVE in the provided facts does not mean the issue is not real; it may mean details are still being assigned or disclosed. Admins should not wait for a CVE to assess exposure.

What to watch: Cisco PSIRT advisories, version-specific fixed releases, mitigations, and any indicators of compromise. Monitor ISE authentication and admin logs for unusual successful logins, new accounts, policy edits, or unexpected network devices. Treat unexplained access as a possible compromise.

Until vendor guidance is confirmed, prioritize containment. Restrict management interfaces, enforce MFA, segment access, and preserve logs. If compromise is suspected, rotate credentials and secrets and engage incident response. The key is to verify affected versions and act on authoritative Cisco guidance.

What to do now

1. Check Cisco PSIRT advisories and version matrices to confirm whether your ISE deployment is affected; do not rely on the absence of a CVE.
2. If a fixed release is available, test and deploy it through an emergency change process; if not, apply vendor mitigations immediately.
3. Restrict ISE administrative interfaces to trusted management networks and enforce multi-factor authentication for all admin access.
4. Review ISE authentication, admin, and policy-change logs for anomalous successful logins, new accounts, or unexpected network devices.
5. Segment network access to limit lateral movement from any compromised endpoint or network device.
6. If compromise is suspected, rotate credentials and secrets, preserve logs, and engage incident response.
7. Track Cisco PSIRT and threat intelligence for CVE assignment, indicators of compromise, and updated guidance.

Original source

The Register — Security