Critical Cisco ISE Zero-Day Lets Attackers Slip Past Authentication

A newly disclosed vulnerability identified as CVE-2026-76460 grants unauthenticated attackers the ability to bypass login controls on Cisco's Identity Services Engine (ISE), a core component used by many organizations to enforce network access policies. Security researchers assigned the flaw the highest possible severity rating, a perfect 10 on the CVSS scale, underscoring the potential for widespread compromise.

The flaw resides in the way ISE validates requests to certain API endpoints. By manipulating authentication tokens, an exploit can trick the system into treating malicious traffic as legitimate, effectively granting the attacker full administrative privileges without presenting valid credentials. Because the vulnerability is embedded in the API layer, it can be triggered remotely and does not require physical access to the network.

Cisco's ISE platform is widely deployed across enterprises, educational institutions, and government agencies to manage user identity, device profiling, and policy enforcement. An attacker who gains control of ISE could reroute traffic, disable security controls, or harvest sensitive data, making the issue a top priority for any organization that relies on the product for network segmentation and compliance.

Following the public disclosure by security outlet Dark Reading, Cisco issued an advisory urging customers to apply the forthcoming patch immediately. The company also recommended temporary mitigation steps, such as restricting API access to trusted IP ranges and enabling multi-factor authentication for any remaining administrative interfaces. While Cisco has not yet released a definitive fix date, its statement emphasizes that a software update is already in development.

The incident highlights a broader industry concern: the security of API-driven management functions. As more network infrastructure moves to cloud‑native and programmable models, robust authentication mechanisms become essential. Experts note that weak or improperly implemented API authentication can expose critical control planes, even when the underlying hardware remains secure.

Enterprises are advised to review their ISE deployment configurations, verify that only authorized personnel have API access, and monitor logs for unusual activity. Organizations that have not yet adopted ISE should factor the recent vulnerability into their risk assessments when selecting network access control solutions. The coming weeks will likely see heightened scrutiny of Cisco's response and a push for faster patch cycles across the industry.