Root on Cisco ISE Takes One API Request — It's the Third Confirmed Cisco Zero-Day in Eight Days
CVE-2026-76460 needs no credentials and has no workaround. It's the third Cisco security-appliance zero-day confirmed under active exploitation in eight days — after Secure Email Gateway, and fresh evidence that a nation-state cluster and a ransomware gang are chaining a firewall-manager bug we already covered.
Cisco Identity Services Engine (ISE) is the box that decides who gets on your network — it authenticates endpoints, checks their posture, and hands policy down to every switch and firewall behind it. On September 16, 2026, Cisco disclosed that one unauthenticated HTTP request to an ISE API endpoint is enough to skip all of that and get root on the appliance itself. There's no workaround, and Cisco's own PSIRT says it's already being exploited.
What the flaw actually does
CVE-2026-76460 is tracked as CWE-648, Incorrect Use of Privileged APIs: an internal API that's supposed to sit behind authentication doesn't enforce it correctly, so a crafted request reaches privileged functionality meant to be gated behind ISE's web-based management login. Cisco's advisory says the bug is "due to insufficient authentication control on an API endpoint" and that successful exploitation grants "command execution with root privileges" — not a foothold, the whole box. It affects ISE and ISE Passive Identity Connector across every release line from 3.1 through 3.5, and Cisco states plainly it applies "regardless of device configuration, deployment mode, or network role." Cisco found it itself, during a Technical Assistance Center support case — not from an outside researcher.
The fix, and why there's no workaround
Cisco's advisory is unusually blunt: "There are no workarounds that address this vulnerability." No feature flag disables the vulnerable API, no config toggle closes it. The only mitigation on offer is using infrastructure ACLs to restrict who can even reach ISE's management and control-plane traffic in the first place — which reduces exposure but doesn't remove the bug.
| Release train | Support status | Fixed in |
|---|---|---|
| 3.0 | End of support | Not patched — migrate off this train |
| 3.1 | Critical fixes only | Patch 12 |
| 3.2 | Critical fixes only | Patch 11 |
| 3.3 | Supported | Patch 12 |
| 3.4 | Supported | Patch 7 |
| 3.5 | Supported | Patch 4 |
Eight days, three Cisco zero-days
ISE isn't the only Cisco security appliance that had a bad September. In the eight days before this disclosure, Cisco confirmed active exploitation on two other products — and one of those confirmations involves a bug we already wrote about in August.
Cisco's eight-day run of confirmed exploitation
- CVE-2026-20079 disclosed (Secure Firewall Management Center)An authentication-bypass-to-root bug in an FMC boot-time process, found internally by Cisco's Brandon Sakai. Patched same day; no confirmed in-the-wild exploitation yet.
- CVE-2026-20316 disclosed and added to KEVA hardcoded, low-privileged FMC account, confirmed under active exploitation at disclosure.
- CVE-2026-20079 confirmed actively exploited; Talos names three intrusion clusters chaining it with CVE-2026-20316Cisco says PSIRT learned of exploitation in August. One cluster is described as "believed to be" Russia's Sandworm; another as "suspected" to be a Qilin ransomware affiliate — both hedged, not confirmed, attributions. CISA adds CVE-2026-20079 to KEV the same day. Talos also previews a broader ASA/FTD/FMC hardening release for "the week of September 16th."
- CVE-2026-76461 disclosed: Secure Email Gateway, root via a crafted emailA SQL-injection flaw in AsyncOS email parsing lets an unauthenticated attacker reach root by sending a malicious message. Added to KEV; no workaround.
- CVE-2026-76460 disclosed (this one), alongside roughly 16 ASA/FTD/FMC hardening advisoriesThe hardening batch is the release Talos previewed a week earlier. The ISE bug is unrelated — found via a support case, not the FMC incident response. CISA adds it to KEV the same day with a three-day federal deadline.
| CVE (confirmed exploited) | Product | CVSS | Root cause | Workaround | Named actors |
|---|---|---|---|---|---|
| CVE-2026-20079 — escalation confirmed Sept 9 | Secure Firewall Management Center | 10.0 | Improper boot-time process → auth bypass → root | No | "Believed" Sandworm; "suspected" Qilin affiliate (both alleged) |
| CVE-2026-76461 — Sept 14 | Secure Email Gateway (AsyncOS) | 9.8 | SQL injection via email parsing (CWE-89) → root | No | Not named |
| CVE-2026-76460 — Sept 16 | Identity Services Engine / ISE-PIC | 10.0 | Incorrect use of a privileged API (CWE-648) → root | No | Not named |
What ISE admins should do this week
- Patch now: 3.1 → Patch 12, 3.2 → Patch 11, 3.3 → Patch 12, 3.4 → Patch 7, 3.5 → Patch 4. Plan to move off 3.0 and the 3.1/3.2 critical-only trains entirely.
- If you can't patch today, there is no feature-flag workaround — the only mitigation is infrastructure ACLs restricting who can reach ISE's management and control-plane interfaces.
- Treat any internet-reachable ISE node as potentially already compromised: review access.log on every deployment node and cross-reference external firewall/NetFlow logs for unexplained uploads or downloads.
- If you also run Secure FMC or Secure Email Gateway, patch CVE-2026-20079/CVE-2026-20316 and CVE-2026-76461 too — all three had active-exploitation confirmations inside the same eight days.
- If you find signs of compromise, Cisco's own guidance is to re-image and restore from a known-good configuration backup rather than patch in place — root access lets an attacker erase the logs you'd use to rule that out.
No Sigma, Suricata, or Nuclei detection has been published for CVE-2026-76460 as of this writing — the only guidance is Cisco's own log-review checklist. Treat this as a real blind spot, not a solved problem.
Data as of 2026-10-09live record →