Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Ravie LakshmananSep 17, 2026Vulnerability / Web Security

Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation.

The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication.

“This vulnerability is due to insufficient authentication control on an API endpoint,” Cisco said. “An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”

The issue affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. It has been addressed in the following versions –

• 3.1 – Fixed in 3.1 Patch 12
• 3.2 – Fixed in 3.2 Patch 11
• 3.3 – Fixed in 3.3 Patch 12
• 3.4 – Fixed in 3.4 Patch 7
• 3.51 -…