Cisco fixes critical network access flaw

Cisco patched a maximum-severity vulnerability in its Identity Services Engine, a platform that controls who can access company networks. The flaw allows unauthenticated attackers to bypass authentication and gain unauthorized access.

“A vulnerability in an API of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to bypass authentication.”

Vulnerability tracked as CVE-2026-76460

The bug received a critical 10 out of 10 severity score and affects Cisco ISE and ISE Passive Identity Connector regardless of device configuration. It stems from insufficient authentication controls on an API endpoint.

Already being exploited in the wild

Cisco's Product Security Incident Response Team confirmed active exploitation of the vulnerability. There are no workarounds available, making patching the only solution to protect against attacks.

“This vulnerability is due to insufficient authentication control on an API endpoint.”

Federal agencies face September deadline

The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog. Federal agencies must patch or disable ISE by September 19, 2026.

Cisco advises hunting for breach signs

Cisco shared indicators of compromise and recommended defenders search for suspicious usernames in access log files on every node. Organizations should also consider re-imaging nodes and restoring from backups if a breach occurred.