Cisco this week disclosed a slew of critical security vulnerabilities impacting its Identity Services Engine (ISE), including a maximum-severity zero-day flaw that's under exploitation.
CVE-2026-76460 is an authentication bypass vulnerability impacting an API in ISE, Cisco's network access control and zero-trust solution. According to the company, the flaw stems from "insufficient authentication control" on an ISE API endpoint.
"An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint," Cisco said in its advisory. "A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface."
The bug was disclosed and patched on Wednesday, and the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the same day. Cisco also disclosed and patched several other bugs impacting ISE and ISE Passive Identity Connector (ISE-PIC) that have similar API authentication issues.