Critical Cisco ISE Flaw Allows Attackers to Bypass Authentication and Gain Root Privileges

Cisco has issued an urgent security advisory warning of a critical authentication‑bypass vulnerability affecting its Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE‑PIC). The flaw, catalogued as CVE‑2026‑76460, carries the maximum CVSS rating of 10.0, indicating a severe risk of remote exploitation that can lead to full system compromise.

The vulnerability enables unauthenticated attackers to sidestep the normal login process and obtain root‑level access on affected devices. By exploiting the weakness, threat actors can effectively take control of the ISE platform, which many enterprises rely on for network access control, policy enforcement, and device profiling. Once the attacker reaches the operating system’s highest privilege level, they can manipulate authentication policies, exfiltrate data, or launch further attacks across the internal network.

According to the advisory, the issue was first reported by the security research group GBHackers, who observed active exploitation in the wild. While the advisory does not disclose the precise attack vector, the description suggests that the flaw resides in the authentication logic of both the core ISE service and its passive identity component, allowing malicious packets to be processed without proper credential verification.

Cisco’s ISE solutions are widely deployed in large‑scale corporate, educational, and government environments to enforce role‑based access and to provide visibility into connected devices. A breach of this nature could undermine the trust model that underpins network segmentation, potentially exposing sensitive assets and compromising compliance with regulations such as PCI‑DSS or HIPAA.

In response, Cisco has released software updates that address CVE‑2026‑76460 and recommends that customers apply the patches as soon as possible. For organizations that cannot immediately update, Cisco advises implementing temporary mitigations, including restricting network access to the ISE management interfaces, disabling unnecessary services, and closely monitoring logs for anomalous authentication attempts.

Security analysts emphasize that the rapid disclosure and high severity of the vulnerability highlight the importance of a robust patch management process. Enterprises that maintain up‑to‑date firmware and regularly audit their authentication mechanisms are better positioned to defend against similar exploits.

While Cisco has not disclosed the exact number of installations impacted, the advisory notes that the flaw affects all supported versions of ISE and ISE‑PIC in active deployment. Customers are urged to review the advisory details, verify their current software versions, and coordinate with Cisco support to confirm remediation status.

The emergence of this zero‑day exploit underscores the broader challenge of securing complex identity and access management platforms. As attackers continue to target critical infrastructure components, organizations are expected to prioritize timely vulnerability assessments and adopt layered defenses to mitigate the risk of credential‑bypass attacks.