SURIQ
Cisco Identity Services Engine (ISE) now has a second maximum-severity flaw under active attack, and it sits on the same interface as the first. CVE-2026-76460 lets an unauthenticated attacker bypass authentication by sending a crafted request to an ISE application programming interface (API) endpoint. Cisco rates it 10.0 on the Common Vulnerability Scoring System (CVSS), its product security team confirms exploitation in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, with a federal patch deadline of September 19. The pattern here says more than the single bug does.
We covered the first exploited ISE zero-day last week, CVE-2026-20192, one of six flaws in a hardening release. CVE-2026-76460 arrived days later in its own advisory, cisco-sa-ISE-ABP-VNSW7Tn5. Two remote, unauthenticated, perfect-score flaws on the same product's control plane inside one week is not a coincidence to patch and forget. It points at where that surface is weak.
A second zero-day on the same control surface
Cisco classes CVE-2026-76460 as incorrect use of privileged APIs. In plain terms, an unauthenticated request to an exposed API endpoint reaches privileged functions it should never be able to touch, which lets an attacker slip past the web-based management interface entirely. Cisco's advisory states its product security team is aware of active exploitation, and reporting from The Hacker News notes that a successful exploit can end in command execution as root. That last detail changes how you have to think about detection, and we come back to it below.
A companion flaw in the same wave, CVE-2026-76423, is also rated CVSS 10.0. Cisco describes it as an authentication bypass by spoofing that would let an attacker read and change ISE configuration and identity data with administrative rights. Cisco has not reported CVE-2026-76423 as exploited, but it is the same failure mode on the same product, and the Canadian Centre for Cyber Security groups both new identifiers with CVE-2026-20192 in its September 17 alert AL26-021. Authentication and account-takeover bugs are the fourth most common class our desk has logged this quarter, 1,168 of them across the last 90 days, behind cross-site scripting, command injection, and SQL injection. A network access control platform is the worst place on the network for one to land.
Why your build number matters more than the CVE list
Here is the part the wire coverage skipped. The fixed builds for CVE-2026-76460 are the same ones Cisco shipped for last week's hardening release, one patch per train from 3.1 to 3.5, shown below. Releases before 3.1 have no fix and must migrate to a fixed train. ISE and the ISE Passive Identity Connector (ISE-PIC) share this table.
So a node already sitting on a current patch is protected against this zero-day too. The trap is procedural. Many teams patched the six flaws from last week's advisory and closed the ticket, then saw a fresh CVE and a fresh advisory ID land this week and assumed it meant a fresh patch cycle. It does not. The right question is not whether you patched CVE-2026-76460, but what build every ISE node is on right now. If your inventory answer is a version, not a CVE list, you can settle this in minutes. There is no workaround, so the build is the only thing that closes it.
Root access means the on-box logs can lie
Because a successful exploit can run as root, an attacker who lands can also edit or delete the logs that would have recorded them. That makes on-box detection necessary but not sufficient. Cisco's advisory points defenders at the API gateway access log, where an intrusion leaves unexpected usernames. Check it on each node, and pull the same log out of an offline Support Bundle where a live attacker cannot reach it.
show logging application ise-kong/access.log | include dummyuser ./ise/logs/apigateway/access.log*.gz
Cisco's example filters for a placeholder name, so treat dummyuser as a stand-in: grep for any account you do not recognize, not that literal string. The more durable signal lives off the box. Cisco explicitly tells defenders to verify against firewall and network flow records for unexpected uploads or downloads to and from the ISE management interface, precisely because a root-level attacker can scrub the local trail. In ATT&CK terms you are watching for exploitation of a public-facing application (T1190), then valid-account use (T1078) once the bypass holds, and indicator removal (T1070) that a compromised appliance can perform on itself. Shipping ISE audit and API logs into centralized log management the moment they are written is what keeps that record honest, since a copy already off the appliance survives whatever the attacker does to the original.
Patch every node, then get the admin plane off the network
Order the work in three steps. First, confirm the build on every ISE and ISE-PIC node and move anything behind the fixed builds in the table above onto a current release today. Second, because CVE-2026-76423 exposes stored identity data to an administrative-level attacker, rotate the secrets ISE holds after you patch: RADIUS shared secrets, TACACS keys, the directory-join account, and administrator passwords. Third, and this is the lesson two perfect-score API flaws in one week are trying to teach, the ISE administrative and API interface should not be reachable from any network that does not need it. Cisco offers no workaround for CVE-2026-76460, so infrastructure access control lists that fence the management plane are the interim control while you patch, and they remain the right control after. An identity system that decides who reaches your network has no business answering unauthenticated requests from the open internet.
If you suspect a node was reached before you patched, treat it as compromised rather than cleaned: re-image it, rebuild from known-good configuration, and run the off-box log review as part of incident response. This is the second exploited ISE zero-day we have flagged in a week; if your patch backlog is still ordered by asset type, an access-enforcement point belongs at the top of it, above general-purpose servers. Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 lists every affected build and is the authoritative source to check against your inventory before you close the ticket.
| ISE / ISE-PIC release | First fixed build |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |