Cisco Issues Emergency Alert for Critical ISE Zero‑Day Actively Exploited in the Wild

Cisco has issued an emergency advisory after confirming that a newly discovered zero‑day flaw in its Identity Services Engine (ISE) is being leveraged by attackers in real‑world campaigns. The vulnerability, catalogued as CVE-2026-76460, carries a perfect CVSS score of 10.0, indicating the highest possible severity.

The bug allows an unauthenticated remote actor to bypass ISE's authentication mechanisms entirely, granting the ability to impersonate legitimate users or devices without presenting valid credentials. Because the exploit works over the network, it can be launched from any location that can reach the vulnerable appliance.

ISE is Cisco's flagship platform for network access control, policy enforcement, and guest provisioning across corporate, campus, and data‑center environments. Enterprises rely on it to verify the identity of users, devices, and endpoints before granting access to sensitive resources. A breach of that trust layer can open a direct path to internal systems, making the flaw especially dangerous for organizations that have standardized on Cisco for perimeter security.

In its advisory, Cisco warned that the vulnerability is already observed in the wild and urged customers to apply the newly released software update without delay. The company also provided temporary mitigation steps, such as restricting network exposure of ISE interfaces and enabling additional authentication checks, for environments where immediate patching is not feasible.

Security analysts note that active exploitation of a CVSS‑10 flaw is relatively rare, underscoring the urgency of the situation. Successful exploitation could enable attackers to move laterally, exfiltrate data, or install additional malicious payloads, potentially compromising entire network segments that depend on ISE for access decisions.

Looking ahead, Cisco has pledged to monitor the threat landscape closely and release further guidance as more information becomes available. The episode highlights the broader challenge of protecting critical infrastructure components that serve as gatekeepers to corporate networks, prompting many security teams to reassess their patch‑management cadence and incident‑response playbooks.