Cisco Gives Federal Agencies Three Days to Patch a Perfect 10

Cisco disclosed a maximum-severity authentication bypass in its Identity Services Engine software on Sept. 16, and the U.S. Cybersecurity and Infrastructure Security Agency gave federal civilian agencies until Sept. 19, a three-day window, to patch it once evidence of active exploitation emerged.

The flaw, tracked as CVE-2026-76460, is due to insufficient authentication control on an API endpoint in Cisco ISE and its ISE Passive Identity Connector, according to Cisco's own advisory. An unauthenticated, remote attacker can send a crafted request to that endpoint, bypass the web-based management interface entirely, and reach command execution as root. It scores 10.0 out of 10 on the CVSS severity scale, the maximum possible.

How Cisco found CVE-2026-76460

Cisco discovered the bug while resolving a Technical Assistance Center support case, The Register reported, meaning an attacker was already inside a live deployment before the company knew the hole existed. Cisco's Product Security Incident Response Team has confirmed active exploitation but has not disclosed who is behind it, how long the attacks have been running, or what intruders did once inside.

Affected release	Fixed version
ISE / ISE-PIC 3.1	Patch 12
ISE / ISE-PIC 3.2	Patch 11
ISE / ISE-PIC 3.3	Patch 12
ISE / ISE-PIC 3.4	Patch 7
ISE / ISE-PIC 3.5	Patch 4
ISE / ISE-PIC 3.0	None; end of life, migration required

There is no workaround. Cisco's advisory says operators who cannot patch immediately should restrict management-interface access with infrastructure access control lists, which reduces exposure without closing the underlying flaw.

A crowded week of Cisco advisories

CVE-2026-76460 shipped alongside two other advisories carrying the maximum 10.0 score and three remote-code-execution flaws scoring as high as 9.9, The Register reported. It also landed just days after CVE-2026-76461, a 9.8-rated flaw in Cisco's email security appliances. The pileup follows a pattern already visible in Cisco's Secure Firewall Management Center flaws exploited by Sandworm and Qilin earlier this month, where named intrusion groups moved on a Cisco n-day before most customers had patched.

The three-day KEV deadline is unusually tight even by CISA's own recent standard; a batch of Linux kernel flaws added to the same catalog carried a longer runway despite drawing criticism for mismatched severity scores. Cisco has not said whether the TAC case that surfaced CVE-2026-76460 involved a customer that was fully compromised, or one that caught the intrusion in progress.

What ISE actually controls

Identity Services Engine is the system that decides which devices and users are allowed onto a Cisco-run network, enforcing policy at the point where a laptop, phone or badge reader first connects. A root compromise of ISE does not just expose the appliance itself; it hands an attacker the authority ISE was built to gate, including the ability to approve devices the network would otherwise reject. That is why Cisco's advisory treats the confidentiality, integrity and availability impact as high across all three categories, the combination that produces a 10.0 score under the CVSS 3.1 formula.

CISA's Known Exploited Vulnerabilities catalog only compels federal civilian agencies directly; it carries no similar deadline for the enterprises, universities and hospitals that also run ISE to control network access. Cisco's advisory carries no revision history yet, which means the company has not had to walk back or add detail to its Sept. 16 account of the flaw.