A perfect CVSS 10.0 is rare. A perfect 10 that gets a three-day federal patch deadline is rarer still. On September 16, 2026, Cisco disclosed CVE-2026-76460 — an unauthenticated API authentication bypass in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) — with confirmation it was already being exploited in the wild and, per Cisco, no workaround available. CISA added it to the Known Exploited Vulnerabilities catalog the same day and gave US civil agencies until September 19 to patch. Two weeks on, the incident reads as the clearest signal yet of where attackers are spending their effort: not on the firewall in front of your network, but on the server that decides who belongs inside it.
This is the retrospective we wish we'd had on day one: what the flaw actually is, why ISE is the crown-jewel target it is, which versions are safe, what exploitation would have looked like in your logs, and the triage checklist identity teams should still be running even after patching. If you arrived here because your ISE deployment is still unpatched — start at the triage checklist now, then come back for the context.
The Bug: One Crafted Request to Total Identity Control
Cisco's advisory (cisco-sa-ISE-ABP-VNSW7Tn5) describes the flaw in one sentence: "insufficient authentication control on an API endpoint" allows an unauthenticated, remote attacker to bypass authentication by sending a crafted request to an affected API endpoint. The blunt version: a specific ISE API — the class of interface administrators use for policy automation, external integrations and session data — trusted requests it should never have trusted. Successful exploitation hands the attacker the ability to issue privileged API requests, which security researchers tracking the bug describe as reaching root-level control of the ISE appliance.
The CVSS math that produces a 10.0 is unforgiving by design: no user interaction, no privileges, no special configuration, network-adjacent at worst and internet-reachable at worst in real deployments, and total impact on confidentiality, integrity and availability of the identity plane. Every factor sits at maximum. When the vulnerable component is the system that authenticates everyone else, "total compromise" isn't hyperbole — it's the actual blast radius.
| Fact | Detail |
|---|---|
| CVE | CVE-2026-76460 |
| Products | Cisco Identity Services Engine (ISE), Cisco ISE Passive Identity Connector (ISE-PIC) |
| Type | Unauthenticated API authentication bypass (CWE-287 class) |
| CVSS | 10.0 Critical |
| Exploitation | Confirmed in the wild at disclosure (Sept 16, 2026); CISA KEV same day |
| Workaround | None (Cisco) — patch is the only complete fix |
| Fixed builds | 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 |
| End-of-life | ISE 3.0 — beyond maintenance, must migrate |
Why ISE Is the Crown Jewel (and Why Attackers Know It)
Cisco ISE is the policy brain for network access control in large enterprise and government networks. It answers the questions every switch, WLC and VPN concentrator defers to it: who is this device, is it compliant, and what VLAN/SGT/ACL does it get? 802.1X and MAB authentication, RADIUS and TACACS+ device administration, posture checks, guest flows, profiler feeds, TrustSec security-group tagging — ISE sits underneath all of it. When you patch ISE, you are patching the system that decides what "inside the network" means.
That's exactly why a pre-auth API bypass on ISE is worth more to an attacker than a pre-auth RCE on almost any other appliance. Own the identity server and you don't need to fight the network — you become the network's source of truth. You can mint policy that quietly routes your traffic unmolested, disable posture checks for your implants, create administrative accounts, harvest endpoint identity data for phishing, and ride the appliance's implicit trust with every other security tool that consumes its feeds. The 2023 Citrix Bleed and the 2024 Ivanti waves taught the same lesson from the edge; CVE-2026-76460 teaches it from the core.
It's also why Cisco's disclosure posture mattered: no workaround left defenders with exposure reduction only — restrict administrative API access at ACL/firmware level, front the admin plane with a jump host, watch the logs — while the real fix propagated through upgrade cycles. ISE patching is not fast. Policy sync across a distributed deployment is not fast. Neither is a maintenance window on the system your entire wired and wireless estate depends on to authenticate. Three days was never a realistic full-remediation window for most enterprises; it was an admission of how bad this one was.
While your identity server is down for patching, keep admin access alive
Upgrading ISE means replica-by-replica maintenance windows. Teams that patch calmly do it from an out-of-band bastion host that doesn't depend on the identity plane being healthy, with a standalone mesh VPN for when primary access depends on the very appliance being rebuilt.
The Two-Week Retrospective: What Actually Happened
September 16: Cisco publishes cisco-sa-ISE-ABP-VNSW7Tn5 covering ISE and ISE-PIC, confirms exploitation in the wild, ships fixed patches across five release trains, and — critically — publishes no workaround. CISA adds CVE-2026-76460 to the KEV catalog the same day with a September 19 federal deadline under BOD timelines. Security press covers it as "another appliance zero-day"; identity teams read the actual advisory and feel their stomachs drop.
The exploitation question: "exploited in the wild before the patch existed" means the zero-day was discovered through incident response or adversary infrastructure observation, not through research. As with September's Citrix NetScaler pre-auth RCEs, the disclosure sequence — forensics first, bulletin second — is itself evidence the bug was working for someone before defenders knew it had a name.
The patching reality: two weeks in, the fixed releases (3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4) are well understood, but ISE estates move slowly. Every week an unpatched ISE with an API endpoint reachable from outside its management segment stays live is a week an adversary with the working exploit — and they exist, because exploitation was confirmed — can act. The retrospective conclusion isn't "patch faster" as an abstraction; it's that identity infrastructure deserves the edge-appliance patch SLA: internet-adjacent, exploitable-in-default-config bugs get days, not quarters.