Cisco's Identity Engine Has Nine New Flaws, and One Scores a Perfect 10

Cisco published a group of security advisories on September 16, 2026 describing nine vulnerabilities in Identity Services Engine (ISE), the platform enterprises use to decide which devices and users may join their networks. One flaw stands out. Tracked as CVE-2026-76460, it lets an unauthenticated attacker bypass the web management interface of an affected appliance over the network, and Cisco's Product Security Incident Response Team says it is aware of active exploitation. The CVSS score is 10.0, the maximum. CISA added it to its Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until September 19 to fix it.

Related reading: Cisco's Email Gateway Zero-Day Hands Attackers Root From a Single Message · Cisco Firewalls Are Under Active Attack, and CISA Just Set a 48-Hour Clock.

The short deadline is the tell. Under Binding Operational Directive 26-04, CISA usually sets a remediation date weeks out, and a three-day window signals that the risk is present tense and the fix is ready to deploy. For any organization that runs ISE and exposes it to the internet, that leaves little room.

What Cisco ISE does

ISE is not a niche product. It is the policy engine behind 802.1X authentication, device profiling and posture assessment for wired, wireless and VPN access. When a laptop, a phone or a badge reader tries to reach the corporate network, ISE is often the system that checks the credential, evaluates the device and returns a yes or a no. It is the technical expression of the zero-trust idea: assume no one is trusted until identity and device health have been verified.

That role is why a bug here matters more than a bug in a peripheral tool. An attacker who can bypass ISE's authentication, or run commands on the appliance, does not merely compromise one server. They reach the control plane that decides who gets onto the network in the first place. When the system checking identity is itself bypassable, the security model built on top of it loses its floor.

The nine flaws

The September 16 disclosures span more than one advisory and range from a near-perfect authentication bypass to command-injection bugs that require credentials first.

• CVE-2026-76460 (CVSS 10.0): an unauthenticated REST API authentication bypass. Cisco attributes it to insufficient authentication control on an API endpoint, and a crafted request is enough to reach the management interface. It is the flaw under active exploitation.
• CVE-2026-76423 (CVSS 10.0): a second unauthenticated REST API authentication bypass, disclosed in a separate advisory covering six additional issues.
• CVE-2026-76424: an arbitrary file access flaw that can lead to remote code execution.
• CVE-2026-76446: an XML external entity flaw that lets an authenticated attacker read specific files on the underlying operating system.
• CVE-2026-20305 and CVE-2026-20306 (CVSS 9.1): command injection in diagnostic tools and the REST API. Both require authentication, but both allow escalation to root.
• CVE-2026-20307 (CVSS 9.9): a remote code execution flaw that requires valid privileged credentials.
• CVE-2026-20176: an authenticated command-execution flaw that escalates to root. On a single-node deployment, exploitation can take the node offline, which would block endpoints that have not already authenticated from reaching the network.
• CVE-2026-20211: a remote code execution issue addressed alongside the others.

The command-injection flaws were reported by researchers at STAR Labs SG, according to Forkast. It is the second time this year that the group has found a root-level command-injection bug in the same platform. Cisco's advisories state that no workarounds address the remote code execution flaws in the group, and that customers should upgrade instead.

Exploited before it was fixed

CVE-2026-76460 came to light through a Cisco Technical Assistance Center support case, which means at least one customer environment was already compromised before the flaw was fully understood and patched. That origin story is familiar. Edge and infrastructure appliances generate little of the endpoint telemetry that security operations centers are built to watch, so their compromise tends to surface when something downstream breaks or when a customer calls the vendor about odd behavior. By then, an intruder who wanted persistence has usually had time to arrange it.

Cisco's advisory confirms in-the-wild exploitation but does not name a threat actor, attribute the activity or describe its scale. The scope-change rating on the CVSS vector means a successful exploit can affect resources beyond the vulnerable component, so a compromised ISE node should be treated as a possible stepping stone rather than an isolated incident.

Why identity infrastructure keeps getting hit

The ISE disclosure fits a pattern that has run through 2026. Delinea's Secret Server, Cisco's own email gateway, Check Point, MikroTik and ConnectWise have all dealt with edge or infrastructure flaws used in the wild, and several of them landed in the CISA catalog. The common thread is position. These systems sit outside the identity perimeter they help enforce, so multi-factor authentication and endpoint controls do not stop the initial exploitation. They run continuously, they speak to the internet when they should not, and they are rarely rebuilt.

Identity and access platforms are a particularly attractive version of that target, because compromising them does not require defeating authentication. It requires rewriting the answer. A network access control system that has been subverted can admit an attacker's device as though it were managed and compliant. In that scenario, conventional monitoring may see normal traffic on a trusted segment, because from the network's point of view everything checks out.

There is also a supply-chain dimension. These platforms are trusted by design, which means their APIs, their external entity handling and their diagnostic tools sit inside the blast radius of the organizations that deploy them. Each convenience feature, from a REST interface that administrators automate against to a diagnostics page that runs commands, is a small expansion of the attack surface that defenders inherit.

Patching, and the ISE-PIC wrinkle

Cisco has published fixed releases across the supported trains: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4, with some fixes arriving in 3.5 Patch 3. Its standing guidance for the remote code execution advisory is to upgrade rather than mitigate, because no workaround exists.

Legacy deployments need attention of a different kind. ISE-PIC, the Passive Identity Connector line, stops at release 3.4, which Cisco has marked end-of-sale. Organizations still running it face these flaws without the option of an in-place upgrade and will have to plan a migration. Gaps like that are where the longest-lived exposure usually sits, because the systems are old enough that no one owns them and important enough that no one wants to switch them off.

What defenders should do

1. Inventory every ISE instance, including lab, staging and forgotten clusters, and determine which are reachable from the internet.
2. Patch to a fixed release on your branch. Where that is impossible on a short clock, restrict access with firewall rules or an ACL and treat the appliance as a monitored asset.
3. Hunt for evidence of exploitation, not just exposure. Check API and web logs for unusual requests before the patch, look for new local accounts or scheduled tasks, and review outbound connections.
4. Rotate anything the appliance can reach. If ISE holds credentials or trust that other systems consume, assume those relationships were inside the blast radius.
5. Treat a positive finding as a breach. Root or administrative access to the identity platform can outlast the box it was obtained on.

Caveats and what to watch

• Attribution is open. The advisories do not name a threat actor or describe how widely CVE-2026-76460 has been used.
• The KEV date is a floor, not a ceiling. September 19 applies to federal civilian agencies. Private organizations face the same exposure without a reporting requirement.
• Scanning usually follows the catalog. Once a flaw lands in the KEV list, mass probing for exposed instances tends to arrive within days. Reducing public reachability is worth doing regardless of the patch timeline.
• The command-injection bugs are not the headline, but they matter. They need credentials, but they end at root, which is a short path from administrative access to full control.

The useful lesson is not that Cisco had a bad week. It is that the systems trusted to decide who belongs on a network are among the highest-value assets an organization owns, and they are frequently the least observed. The teams that come through incidents like this intact tend to be the ones that already knew what they had and could patch it before a scanner showed up.

Cover: Cisco Systems Headquarters (Building 10), San Jose, by Travis Wise (CC BY 2.0) via Wikimedia Commons.