Cisco Patches Critical ISE Vulnerability Actively Exploited by Attackers

Cisco has patched a critical vulnerability in its Identity Services Engine (ISE) platform that was being actively exploited by attackers. The CVE-2026-76460 bug, which affects Cisco ISE version 10.0 and earlier, allows unauthorized access to the web-based management interface of affected devices.

According to Cisco, a successful exploit could grant an attacker access to sensitive information and potentially lead to further compromise. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76460 to its Known Exploited Vulnerabilities list due to the active exploitation.

Security experts warn that this vulnerability is not just another bug, but a potential gateway for broader compromise. Robert Coles, senior manager of threat intelligence security at Black Duck, emphasizes the importance of patching quickly and looking for signs of attackers already inside.

John Strand, owner at Black Hills Information Security, agrees that teams should patch right away and take ISE off the open internet. He believes it's highly probable that this flaw could escalate to a ransomware case.