Cisco patches max-severity ISE zero-day under active exploitation

Cisco released security updates for a maximum-severity authentication bypass in Identity Services Engine and ISE Passive Identity Connector, tracked as CVE-2026-76460, and said its Product Security Incident Response Team is aware of active exploitation. The flaw stems from insufficient authentication control on an API endpoint; a crafted request can bypass the web-based management interface and yield root-level command execution. Cisco reported finding the defect during a technical support case and published indicators of compromise, advising teams to inspect access.log files on every node and re-image suspected systems. No workarounds exist, so applying fixed releases is the recommended remediation. CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within three days.