CVE-2026-76460Active Exploitation(cisco / identity_services_engine)

‼️ WARNING - New Cisco ISE flaw CVE-2026-76460 is under active exploitation. The CVSS 10.0 auth bypass has no workaround, and successful exploitation may lead to root-level command execution. Affected versions, fixes, and compromise checks: https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html

Cisco ISE API with no auth check. CVSS 10.0. Exploited & Public PoC indexed!!! CVE-2026-76460: Insufficient authentication on an ISE / ISE-PIC API endpoint. Crafted request bypasses the web management UI. Cisco PSIRT confirmed in-the-wild use. Fixed: 3.1p12 / 3.2p11 / 3.3p12 / 3.4p7 / 3.5p4. No workaround besides locking the management plane. https://github.com/S3v3n-JG/CVE-2026-76460 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #NetworkSecurity #KEV #RCE

🛡️ We added Cisco Identity Services Engine vulnerability CVE-2026-76460 & Acronis Backup vulnerability CVE-2026-87886 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/fmmHoeHT3d

Nueva vulnerabilidad Zero-Day en CISCO ISE permite eludir la autenticación y está siendo explotada en ataques activos (CVE-2026-76460) https://blog.segu-info.com.ar/2026/09/nueva-vulnerabilidad-zero-day-en-cisco.html

🚨 CISA ADDS CISCO ISE CVE TO KEV CATALOG CISA has added CVE-2026-76460 (Cisco Identity Services Engine / ISE-PIC authentication bypass via incorrect use of privileged APIs) to its Known Exploited Vulnerabilities Catalog. Per Cisco’s advisory: • Unauthenticated remote attacker can bypass web management authentication with a crafted API request • CVSS 10.0; no workarounds (iACL mitigation only) • Cisco PSIRT is aware of active exploitation; successful exploitation may yield root command execution ⚠️ Analyst Note: This is an official CISA KEV addition based on evidence of active exploitation, paired with Cisco’s Sep 16 PSIRT advisory — not an unverified underground claim. Federal agencies should prioritize per BOD 26-04. Organizations running ISE / ISE-PIC should patch to fixed releases and follow Cisco’s access.log / re-image guidance if compromise is suspected. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 #DDW #DarkWeb #ThreatIntelligence #CyberSecurity #Cisco #KEV

🚨 Upozorňujeme na aktivně zneužívanou zero-day zranitelnost v Cisco Identity Services Engine (ISE) a Cisco ISE Passive Identity Connector (ISE-PIC), CVE-2026-76460. Zranitelnost typu obejití autentizace (CVSS 10.0) je způsobena nedostatečnými autentizačními kontrolami na koncovém bodu API. Neautentizovaný vzdálený útočník může zasláním speciálně vytvořeného požadavku obejít autentizaci, získat neoprávněný přístup do webového administračního rozhraní a následně dosáhnout spuštění příkazů s oprávněními root. Zranitelnost je aktivně zneužívána v reálných útocích a nevyžaduje žádná oprávnění ani interakci uživatele. Postiženy jsou všechny konfigurace Cisco ISE a ISE-PIC. 📌Doporučujeme aktualizovat na následující opravené verze: Cisco ISE/ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 nebo 3.5 Patch 4. U verze 3.0, která již není podporována, doporučujeme migraci na podporovanou verzi obsahující bezpečnostní opravu.

Cisco disclosed its second actively exploited zero-day vulnerability in as many days, presenting its customers with back-to-back threats to address in unrelated products. The latest zero-day — CVE-2026-76460 — has a maximum-severity rating and was exploited before Cisco disclosed and patched the vulnerability Wednesday. The defect in an API of Cisco Identity Services Engine (ISE) allows a remote attacker to bypass authentication and gain full control of the affected device. https://scoopmedia.co/4iEKmJo

تجاوز المصادقة في Cisco ISE يجري استغلاله فعليًا كشفت Cisco في 16 سبتمبر عن CVE-2026-76460 بدرجة خطورة 10/10. تتيح الثغرة لمهاجم بعيد وغير مسجل تجاوز واجهة الإدارة في ISE وISE-PIC، وقد يصل إلى تنفيذ أوامر بصلاحيات root. لا يوجد حل مؤقت كامل، وأكدت Cisco وجود استغلال فعلي. لماذا يهم: ISE يتحكم في هوية المستخدمين والأجهزة وسياسات دخولهم إلى الشبكة؛ واختراقه قد يمكّن المهاجم من العبث ببوابة الثقة نفسها. الإجراء: تثبيت الرقعة المحددة للإصدار فورًا، وقصر واجهات الإدارة عبر قوائم الوصول. يجب فحص ise-kong/access.log في كل عقدة ومقارنته بسجلات الجدار الناري. عند ظهور دليل اختراق، توصي Cisco بإعادة تهيئة العقدة من نسخة سليمة.

CVE-2026-76460 (CVSS 10.0): a zero-day in Cisco ISE, discovered during a TAC support case and already being exploited in the wild. One crafted API request lets an unauthenticated attacker fully bypass authentication, regardless of how the device is configured. Part of a nine-CVE Cisco ISE disclosure, two of which are CVSS 10.0. Added to CISA's KEV catalog. Patch now. Details: http://vulntracker.io/cves/CVE-2026-76460 #Cisco #CVE #ZeroDay #VulnTracker

【今日のしすこ】Cisco ISEでCVSSスコア10のゼロデイ脆弱性。CVE-2026-76460はAPIの認証不足に起因して遠隔から無認証でroot取得可能。二日前に開示されたSEGのゼロデイCVE-2026-76461とは別件。緩和策はiACLを使用してた管理プレーンと制御プレーンへのアクセス制限。 https://cyberscoop.com/cisco-ise-zero-day-cve-2026-76460/

🚨 VIEH Security analyzed the active exploitation of Cisco Identity Services Engine (ISE) CVE-2026-76460 - a vulnerability affecting the system that controls identity and access across enterprise networks. CVE-2026-76460: CVSS: 10.0 Unauthenticated remote attacker No user interaction Authentication bypass Unauthorized access to the ISE management interface Potential complete compromise of the affected appliance VIEH Attack-Surface Analysis The concern is bigger than compromising one server. Cisco ISE can sit at the center of: Network authentication Device identity User identity Access policies Security-group enforcement Network authorization Compromising the identity control plane can therefore have a much wider blast radius than compromising an ordinary application server. VIEH Key Finding When the identity enforcement layer is compromised, the attacker is attacking the mechanism that decides who and what is trusted on the network. That changes the incident-response priority. Don't investigate only: “Was the ISE appliance accessed?” Investigate: Authentication-policy changes Unexpected administrator activity New or modified network-access policies Unusual API requests Configuration changes Unexpected changes to identity/device records Authentication anomalies following suspected exploitation Affected Releases ISE 3.1 → before Patch 12 ISE 3.2 → before Patch 11 ISE 3.3 → before Patch 12 ISE 3.4 → before Patch 7 ISE 3.5 → before Patch 4 Cisco confirms active exploitation and provides no workaround for CVE-2026-76460. ⚠️ VIEH assessment: An exploited ISE appliance should be treated as a potential network identity-control compromise, not simply another vulnerable server. Patch immediately and investigate the authentication and authorization plane for changes that occurred around the exploitation window. - VIEH Security Team #VIEHThreatHunt #ThreatIntel #Cisco #CiscoISE #CVE #CyberSecurity

Second Cisco zero-day this week a perfect CVSS 10.0. CVE-2026-76460 lets an unauthenticated attacker bypass Cisco ISE authentication and reach root. Already exploited, already in CISA's KEV. https://vulntracker.io/blog/cve-2026-76460-cisco-ise-auth-bypass #Cisco #CVE #ISE #CyberSecurity #ZeroDay

⚠️ New Actively-Exploited Vulnerability • CVE-2026-76460 in Cisco ISE • Unauthorized access via API misuse • Actively exploited in the wild • Listed in CISA KEV Mitigation: Apply vendor instructions ensuring CISA BOD compliance. Full report: 🔗 https://darkfeed.io #Cisco #CyberSecurity #ThreatAlert

Cisco ISE. Unauth API. Skip the login page. CVE-2026-76460. Cisco PSIRT says active exploitation. CISA KEV yesterday. Federal due Friday. No workaround. Root if they get in. If the management plane is reachable from anywhere you don't trust, patch or assume it's already owned. Mmkay. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

Cisco disclosed its second actively exploited zero-day vulnerability in as many days, presenting its customers with back-to-back threats to address in unrelated products. The latest zero-day — CVE-2026-76460 — has a maximum-severity rating and was exploited before Cisco disclosed and patched the vulnerability Wednesday. The defect in an API of Cisco Identity Services Engine (ISE) allows a remote attacker to bypass authentication and gain full control of the affected device. https://scoopmedia.co/4xGZ2LX

CVE-2026-76460 is under active exploitation against Cisco ISE and ISE-PIC. CVSS 10.0, unauthenticated auth bypass that can lead to root-level command execution. No full workaround exists. → Patch every node in distributed deployments → Review API, admin, and firewall telemetry for prior compromise #Cisco #ISE #VulnerabilityManagement

🚨 BREAKING: Cisco ISE CVE-2026-76460 is being actively exploited in the wild. Full technical breakdown, IOCs & remediation: https://thecybersecguru.com/news/cisco-ise-cve-2026-76460-authentication-bypass/ The CVSS 10.0 flaw allows unauthenticated remote attackers to bypass authentication through an API endpoint and gain access to Cisco ISE. Successful exploitation can lead to root-level command execution. ⚠️ No workaround is available. Affected: Cisco ISE + ISE-PIC 🔎 Hunt for suspicious usernames in ise-kong/access.log. Patches are available now.

🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-32432 CVE-2025-57819 CVE-2026-48908 CVE-2026-76460 CVE-2026-85706 ..🧵👇

Warning: Critical vulnerabilities across #Cisco products (#ISE, #NexusDashboard, #SecureFirewall #FMC). #CVE-2026-76460 (CVSS: 10.0) is actively exploited in the wild leading to network compromise. More info: https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-cisco-products-patch-immediately #Patch #Patch #Patch

Authentication logs are not always enough when authentication itself is what failed. CVE-2026-76460 bypasses the control that should have protected the Cisco ISE management API. That makes surrounding telemetry unusually important: firewalls, proxies, load balancers, and flow records may retain evidence the application cannot fully explain. This is a broader incident-response pattern worth remembering across Linux-based infrastructure. **In practical terms, it is a good time to:** - verify management-plane traffic is logged outside the appliance - retain source IP, timestamp, destination, and connection metadata long enough for retrospective review - compare unexplained management connections with ISE configuration changes - confirm clocks are synchronized across the appliance and external log sources #IncidentResponse #ThreatDetection #LinuxSecurity #NetworkSecurity https://linuxsecurity.com/news/network-security/cisco-ise-authentication-bypass