CVE-2026-76460 is an authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) caused by insufficient authentication control on an API endpoint. An attacker can exploit this flaw by sending a specially crafted request to the affected API, bypassing authentication and gaining unauthorized access to the device's web management interface. Cisco has confirmed active exploitation of this zero-day vulnerability in the wild. The vendor has released security updates for ISE versions 3.1 through 3.5, with specific patch releases addressing the issue. Cisco advises monitoring access logs for suspicious usernames and network logs for anomalous activity, recommending re-imaging and restoring from backups if compromise is suspected. The vulnerability is considered critical due to its maximum severity rating and active exploitation status. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog and issued an emergency directive for patching.

Successful exploitation allows remote attackers to bypass authentication controls on Cisco ISE and ISE-PIC devices, granting unauthorized access to the web-based management interface. This access can lead to full compromise of the affected device, including potential command execution with root privileges. The vulnerability is actively exploited in the wild, increasing the risk of unauthorized network access and control. There are no known mitigations other than applying the vendor's patches. The impact is critical given the ability to bypass authentication and the active exploitation reported.

Cisco has released official security updates for Cisco ISE and ISE-PIC versions 3.1 through 3.5 (specifically 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4) that fully remediate this vulnerability. Customers should apply these patches immediately. No workarounds are available. Cisco also recommends monitoring access.log files for suspicious usernames and reviewing firewall and network logs for unusual activity. If compromise is suspected, re-image affected nodes and restore from known-good backups. The Cybersecurity and Infrastructure Security Agency (CISA) has mandated patching within three days for federal agencies. Organizations should follow Cisco's guidance and prioritize patch deployment to mitigate ongoing attacks.