Cisco ISE Zero-Day Vulnerability Prompting Emergency Patch

Active exploitation of a critical Cisco ISE zero-day vulnerability has prompted emergency patches to address a severe authentication bypass flaw.

Cisco Issued Emergency Patches

Cisco issued emergency patches on Wednesday to address a critical authentication bypass vulnerability in Identity Services Engine (ISE) that is being actively exploited in the wild as a zero-day. The flaw, tracked as CVE-2026-76460 with a CVSS score of 10/10, affects an API endpoint within the appliance, which lacks adequate authentication mechanisms. This allows attackers to send specially crafted requests to the API, bypassing the web-based management interface to gain unauthorized access to the affected device.

Vulnerability Details

Both Cisco ISE and ISE Passive Identity Connector (ISE-PIC) are impacted, regardless of configuration settings. No temporary fixes are available, but administrators are advised to implement infrastructure access control lists (iACLs) to limit traffic to the vulnerable device. To resolve the issue, customers must upgrade to specific software versions, including ISE or ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12.

Impact and Risks

Cisco’s Product Security Incident Response Team (PSIRT) confirmed awareness of ongoing exploitation and emphasized the urgency of applying the patches. The company stated that failure to address the vulnerability leaves systems exposed to potential compromise. The exploit’s successful execution could grant attackers root-level privileges, enabling them to execute arbitrary commands and conceal or delete indicators of compromise (IoCs).

Recommendations for Organizations

Organizations are urged to inspect ‘access.log’ files for anomalous activity, particularly unusual usernames. In distributed environments, logs from all nodes must be reviewed. Any suspicious entries should trigger immediate investigation. Additionally, administrators are advised to cross-reference network and firewall logs outside the affected device to identify signs of unauthorized access, such as unexpected data transfers.

CISA Involvement and Compliance

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, mandating federal agencies to apply the patches within three days in compliance with BOD 26-04 requirements. The vulnerability’s exploitation highlights the risks associated with unpatched infrastructure, as attackers can leverage it to establish persistent access and evade detection.

Conclusion

Administrators must act swiftly to apply the emergency patches and implement additional security measures to mitigate the risk of exploitation. The incident underscores the critical importance of proactive vulnerability management and timely patch deployment.

About Author

Anuj

See author's posts