Cisco Warns of Maximum-Severity ISE Zero-Day Actively Exploited in Attacks

Cisco has issued an urgent security advisory warning of a maximum-severity vulnerability in its Identity Services Engine (ISE) that is currently being exploited in active attacks. The company has released software updates to remediate the flaw, which affects ISE deployments globally. While the specific CVE identifier has not been disclosed in the initial report, the advisory marks the issue as critical and confirms that exploitation is occurring in the wild.

The Identity Services Engine is a core component in many enterprise networks, providing centralized policy management, authentication, and authorization for network access. A vulnerability of this severity could allow an attacker to compromise the ISE appliance, potentially leading to unauthorized network access, lateral movement, or disruption of security controls.

Cisco has not yet provided technical details on the attack vector or the exact impact of the vulnerability, but the active exploitation suggests that threat actors have already developed working exploits. The company is urging all customers running affected versions of ISE to apply the available security updates as soon as possible.

Organizations that cannot immediately patch should consider implementing workarounds or additional monitoring to detect signs of compromise. Given the critical nature of the flaw and its active exploitation, prompt action is essential to protect network infrastructure.