Executive brief
Cisco Identity Services Engine (ISE) is a critical network access control and identity management system used by enterprises to manage authentication and authorization. A vulnerability in how ISE uses privileged APIs has been actively exploited by attackers to gain unauthorized access and control of affected systems. Federal agencies and all organizations are urged to prioritize patching this vulnerability immediately due to its active exploitation and high-risk nature.
Technical details
CVE-2026-76460 is an incorrect use of privileged APIs vulnerability in Cisco Identity Services Engine. The vulnerability allows attackers to bypass authentication or authorization controls through improper use of privileged APIs, potentially granting total control of the affected system post-exploitation. The vulnerability is network-accessible and has evidence of active exploitation in the wild. No specific technical details on preconditions or exact attack vectors are provided in the advisory, but the impact is considered high-risk per CISA's KEV Catalog inclusion criteria. Organizations should apply available patches immediately as indicated by CISA's Binding Operational Directive 26-04.
Affected products
- Cisco Identity Services Engine
Timeline
- 2026-09-16: kev added: Added to CISA Known Exploited Vulnerabilities Catalog based on evidence of active exploitation