Cisco Issues Critical Zero‑Day (CVE‑2026‑76460) in Identity Services Engine Actively Exploited
What Happened – Cisco disclosed a maximum‑severity vulnerability (CVE‑2026‑76460) in its Identity Services Engine (ISE) and ISE‑Passive Identity Connector. The flaw allows remote attackers to bypass authentication by sending a crafted request to an API endpoint, and Cisco’s PSIRT confirms the bug is being exploited in the wild.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient authentication controls on management APIs – a core access‑control objective that continuous‑control programs must monitor and evidence.
- Highlights the need for real‑time detection of anomalous API activity and immutable log collection to provide a defensible audit trail.
- Shows that without a documented remediation process (patch management, re‑imaging, log review) organizations cannot prove due diligence to auditors.
Who Is Affected – Enterprises across all sectors that rely on Cisco ISE for network access control, including finance, healthcare, manufacturing, and cloud‑service providers.
Recommended Actions
- Deploy the Cisco‑provided patches for ISE (3.1‑Patch 12, 3.2‑Patch 11, etc.) immediately.
- Verify firmware versions on every ISE node and re‑image any system showing suspicious usernames in
access.log. - Enable continuous monitoring of API traffic and firewall logs for unexpected external IP connections.
- Archive raw logs in a tamper‑evident store to satisfy audit‑readiness requirements.
Source: BleepingComputer
Technical Notes
- Attack vector: Exploitation of an unauthenticated API endpoint (Vulnerability Exploit).
- CVSS: Not published, but Cisco rates it “maximum severity” (≈9.8).
- Data at risk: Unauthorized access to network resources; potential command execution with root privileges.
- Related CVEs: CVE‑2026‑76423 (also authentication bypass) and several other critical issues patched concurrently.
Source: same as above