Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco has issued an urgent security advisory warning of a maximum-severity zero-day vulnerability affecting Identity Services Engine (ISE), a widely used network access control (NAC) and policy enforcement platform. The vulnerability, tracked as CVE-2026-76460 and assigned a CVSS score of 10.0, is being actively exploited in the wild.

The flaw stems from insufficient authentication control on an API endpoint. An unauthenticated, remote attacker could exploit this vulnerability to bypass authentication entirely, potentially gaining unauthorized access to ISE administrative functions or sensitive network policy data. Given ISE's role in enforcing security policies across enterprise networks, successful exploitation could lead to broader compromise of network infrastructure.

Cisco has confirmed active exploitation of this zero-day, but specific attack details have not been disclosed. The company has not yet released a software patch as of the publication date. Organizations using ISE are strongly advised to monitor Cisco's security advisories for updates and implement recommended mitigations immediately.

This advisory follows a pattern of increasing zero-day disclosures in network infrastructure products, underscoring the critical importance of prompt patching and proactive security monitoring.