Cisco Issues Emergency Patch for Critical ISE Flaw Exploited in the Wild

Cisco has issued emergency security updates to remediate a maximum‑severity vulnerability in its Identity Services Engine (ISE) platform, confirming that the flaw is already being leveraged by attackers in active campaigns.

ISE serves as the core network access control system for many enterprises, providing authentication, authorization and accounting services for wired, wireless and VPN connections. The newly disclosed bug permits unauthenticated remote code execution, potentially giving threat actors full control over the management plane of affected devices.

In its advisory, Cisco warned that malicious actors are exploiting the weakness in the wild, targeting organizations that depend on ISE to enforce device‑level policies. Successful exploitation could allow attackers to bypass security controls, move laterally across the network and exfiltrate data.

The vendor released patches for all supported ISE versions and urged customers to apply them without delay. Cisco also provided temporary mitigations, such as disabling vulnerable services and restricting access to the management interface, to reduce exposure while patches are deployed.

Security researchers have observed exploitation attempts shortly after the vulnerability was first reported, noting anomalous traffic to the ISE management ports and the presence of known indicator‑of‑compromise patterns in compromised environments.

The incident highlights persistent concerns about the security of critical network‑infrastructure software, especially as ISE is widely deployed across sectors ranging from education and healthcare to government and finance.

Cisco recommends that organizations conduct an immediate inventory of ISE installations, verify patch status, and enable logging and alerting for suspicious activity. Incident‑response teams should be prepared to investigate any signs of compromise.

Analysts suggest that while the prompt release of patches may curb the current wave of attacks, threat actors could pivot to other network‑management products if unpatched ISE systems remain in the field.

This update forms part of Cisco’s broader strategy to address zero‑day flaws quickly; the company pledges ongoing monitoring, further advisories and collaboration with partners to safeguard critical network services.