Cisco Rushes Emergency Fix for Second Perfect-10 ISE Zero-Day

Cisco pushed out an emergency patch this week for a second maximum-severity, actively-exploited zero-day in its Identity Services Engine (ISE) software — the network access control system that decides who and what gets onto a corporate network — just one day after quietly fixing six other ISE vulnerabilities in a routine hardening release. I’ve been tracking Cisco ISE bugs since the CVE-2025-20337 mess blew up last summer, and I can’t remember two perfect-10 CVSS scores landing on the same product 24 hours apart before. If your organization runs ISE anywhere, this is not a patch to leave in the backlog.

What Actually Happened

On September 16, 2026, Cisco published its “ISE Hardening Release: September 2026” advisory, bundling six CVEs (CVE-2026-20130, CVE-2026-20192, CVE-2026-20194, CVE-2026-20234, CVE-2026-20237, and CVE-2026-20287) with severity scores ranging from 6.5 up to a full 10.0. One of those, CVE-2026-20192, was already being exploited in the wild when the advisory went out. Cisco said the issues were caught “during internal security testing using existing testing processes as well as frontier AI models” — which is a notable admission on its own, since it means an AI model helped surface at least part of a bug chain serious enough to hit CVSS 10.

Then, barely a day later, Cisco dropped a second advisory, cisco-sa-ISE-ABP-VNSW7Tn5, for an unrelated authentication bypass tracked as CVE-2026-76460. This one also scores a perfect 10.0 and is also being actively exploited. Cisco says it found this second flaw during a routine technical support case, not through its own testing pipeline — meaning a customer likely stumbled onto evidence of an intrusion before Cisco’s engineers did.

Why CVE-2026-76460 Is the One to Worry About

The root cause is almost embarrassingly simple: an API endpoint on ISE and ISE Passive Identity Connector (ISE-PIC) doesn’t apply sufficient authentication controls. An unauthenticated, remote attacker just sends a crafted request to that endpoint and walks straight past the web-based management login. From there, successful exploitation hands the attacker command execution with root privileges on the appliance itself.

That matters more than a typical “remote code execution” headline because of what ISE actually does. It’s the box that enforces network access policy — deciding which devices, users, and endpoints are allowed onto which network segments. Root access on ISE doesn’t just compromise one server; it lets an attacker rewrite the access policy for the entire network it controls, pull stored credentials, wipe logs to erase evidence of the intrusion, and then pivot laterally into every segment ISE was supposed to be protecting. It’s less like breaking into a house and more like stealing the building’s master keycard system.

Cisco confirmed there is no workaround for either advisory. The only fix is upgrading to a patched release: ISE or ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12. Versions 3.0 and earlier need to move to a currently supported release entirely.

Quick-Reference: What’s Confirmed

Federal Agencies Have Until Tomorrow

CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, and under Binding Operational Directive 26-04 that gives Federal Civilian Executive Branch agencies until September 19, 2026 to patch or disconnect affected ISE instances. A three-day turnaround for a KEV entry is aggressive even by CISA’s standards, which tells you how seriously the agency is treating active exploitation of a perfect-10 authentication bypass on network access control infrastructure. Enterprises outside the federal mandate don’t get a legal deadline, but I’d treat this the same way: patch this weekend, not next sprint.

No specific threat actor has been publicly attributed to either round of exploitation yet, and Cisco hasn’t disclosed exactly how many organizations have been hit. That’s fairly typical for the first 48 hours after a KEV listing — attribution research usually trails the patch by a week or two.

This Is the Third ISE Zero-Day Since Last Summer

Cisco ISE has had a rough run. CVE-2025-20337 and CVE-2025-20281 both hit critical severity and saw active exploitation back in the summer of 2025. Add CVE-2026-76460 and you’ve got three maximum-or-near-maximum severity, actively exploited ISE vulnerabilities inside about 14 months. ISE sits at a genuinely juicy spot in the network — it’s trusted by design, it touches every device that connects, and a lot of large organizations don’t rotate it as often as they should because touching network access control in production is scary. Attackers have clearly noticed the pattern, and I wouldn’t bet this is the last ISE advisory we cover this year.

If you’re running any flavor of ISE or ISE-PIC, the move right now is boring but non-negotiable: confirm your version against the patch list above, schedule the upgrade window today, and check your logs for the kind of unusual API calls to management interfaces that Cisco’s advisory describes. If your team already went through the ShieldCrash Windows Defender bypass scramble last week, this is the same drill — just on network infrastructure instead of endpoints.

Frequently Asked Questions

Is Cisco ISE vulnerable even if I haven’t changed any default settings?

Yes. Cisco’s advisory states the authentication bypass affects the product regardless of device configuration, since it’s a flaw in how the API endpoint itself validates requests, not something introduced by a specific setup choice.

What’s the difference between CVE-2026-20192 and CVE-2026-76460?

They’re two separate bugs disclosed a day apart. CVE-2026-20192 was one of six vulnerabilities fixed in Cisco’s routine September hardening release and was found through internal testing. CVE-2026-76460 is a standalone authentication-bypass advisory that Cisco discovered through a customer support case. Both score CVSS 10.0 and both are being actively exploited, but they’re independent flaws with independent advisories.

Is there a temporary workaround if I can’t patch immediately?

No. Cisco explicitly states there is no workaround for either vulnerability. Restricting management-interface access at the network firewall level can reduce exposure, but it isn’t a substitute for the patch and doesn’t fully close the API-level flaw.

How urgent is this compared to a typical Cisco advisory?

Very. CISA’s three-day KEV remediation window (versus the more common 2-3 week window) and the fact that this is the second perfect-10, actively-exploited ISE bug in as many days both signal this is being treated as an emergency, not a routine patch cycle.