Cisco Patches Actively Exploited Authentication Bypass in ISE

Cisco has patched an actively exploited authentication bypass vulnerability in its Identity Services Engine (ISE) and ISE-PIC platforms. The flaw, tracked as CVE-2026-76460, allows a remote, unauthenticated threat actor to gain unauthorized access by bypassing the web-based management interface.

The affected API endpoint is part of the management plane used to administer the appliance, rather than the network authentication functions that validate users and devices. Successful exploitation may allow command execution with root privileges.

Cisco has released fixes for ISE versions 3.0 through 3.5, regardless of deployment configuration. The company recommends upgrading to a fixed release, restricting management-interface access, and performing a compromise assessment across appliance and network logs to reduce exposure and identify potential exploitation.