# Cisco Discloses Critical Maximum-Severity Zero-Day Under Active Exploitation in Identity Services Engine

Source: TechNewsList (https://technewslist.com)
Canonical URL: https://technewslist.com/en/article/cisco-zero-day-identity-services-engine-active-exploitation
Section: Software (https://technewslist.com/en/software)
Author: TechNewsList
Language: en
Published: 2026-09-18T05:30:49.522+00:00
Updated: 2026-09-18T05:30:49.681762+00:00

> CVE-2026-76460 enables unauthenticated attackers to bypass web administrative authentication controls and compromise enterprise network access.

## TL;DR
- Cisco warned of CVE-2026-76460, a maximum-severity 10.0 zero-day in Identity Services Engine.
- The vulnerability allows remote unauthenticated attackers to gain root access to appliances.
- State-aligned threat actors are actively exploiting the flaw against corporate networks.
- CISA added the zero-day to its Known Exploited Vulnerabilities catalog with a 48-hour deadline.

## Key points
- The flaw stems from input validation and session serialization failures in the ISE web administrative interface.
- Attackers can execute arbitrary operating system commands with root privileges via crafted POST requests.
- Cisco ISE controls enterprise network access control, VPN authorization, and multi-factor authentication routing.
- Threat actors deployed stealth rootkits disguised as routine administrative cron jobs to maintain persistence.
- Urgent security hotfixes were released for ISE versions 3.1, 3.2, and 3.3.
- Cyber insurers warn that delayed patching of CISA-mandated zero-days could impact policy coverage.

## What happened

Networking giant Cisco Systems published an urgent security advisory on September 17, 2026, warning enterprise administrators of a maximum-severity zero-day vulnerability affecting its Identity Services Engine (ISE). Tracked as CVE-2026-76460 with a CVSS base score of 10.0, the flaw enables unauthenticated remote threat actors to completely bypass web administrative authentication mechanisms and execute arbitrary commands with root privileges on exposed appliances.

Cisco's Product Security Incident Response Team (PSIRT) confirmed that sophisticated cyber espionage threat groups are actively weaponizing the zero-day against government agencies, defense contractors, and Fortune 500 corporate networks. The United States Cybersecurity and Infrastructure Security Agency (CISA) responded immediately by adding CVE-2026-76460 to its Known Exploited Vulnerabilities catalog, ordering all federal civilian executive branch agencies to patch or isolate affected systems within 48 hours.

## Why it matters

Cisco Identity Services Engine serves as the foundational security gatekeeper for enterprise corporate environments, managing policy enforcement, network access control (NAC), multi-factor authentication routing, and endpoint compliance validation across wired, wireless, and VPN connections. A compromise of the ISE controller compromises the entire enterprise security perimeter, allowing attackers to manipulate network segmentation rules, grant themselves persistent administrative privileges, and eavesdrop on sensitive internal corporate traffic.

Because Cisco ISE is deployed within mission-critical infrastructure across thousands of large organizations, an unauthenticated remote root exploit represents the highest possible tier of enterprise cybersecurity risk. Incident responders warn that attackers who gain administrative access to ISE appliances can pivot laterally into Active Directory domain controllers, industrial operational technology networks, and cloud management consoles without triggering standard endpoint detection alerts.

## Technical details

The root cause of CVE-2026-76460 lies in an improper input validation and session serialization flaw within the Apache Struts-based administrative web interface and RESTful API management subsystem of Cisco ISE. By sending specially crafted HTTP POST requests containing malformed Java serialized object headers to specific unauthenticated management endpoints, an external attacker can induce a deserialization failure that forces the web service into an unauthenticated administrative session state.

Once administrative session bypass is achieved, the vulnerability allows the attacker to access backend debugging utilities that lack input sanitization. This permits command injection directly into the underlying Linux operating system, executing arbitrary payloads with root privileges.

![Cybersecurity vulnerability research and enterprise firewall threat protection visual.](https://rkhynbcsbnkkcwgexzwg.supabase.co/storage/v1/object/public/media/api/1789709440376-dmuv5m-cisco-zero-day-identity-services-engine-active-exploitation-inside-1-b0676611e9.webp)
*Network security appliances and identity policy controllers face sophisticated zero-day attacks from advanced persistent threat groups.*

Telemetry from incident response firms indicates that threat actors deployed custom stealth rootkits disguised as legitimate Cisco administrative cron jobs, modifying local cryptographic certificates to maintain persistence even through soft software restarts. Cisco released urgent hotfixes for ISE versions 3.1, 3.2, and 3.3, while urging customers unable to apply patches immediately to restrict web administrative management access strictly to trusted internal management subnets.

## Market / industry impact

The disclosure of CVE-2026-76460 has triggered an emergency patching scramble across enterprise IT and security operations centers worldwide. Security teams are conducting round-the-clock forensic audits, inspecting web access logs for anomalous HTTP POST payloads directed at ISE management ports (TCP 443 and 8443).

Managed detection and response providers reported surges in enterprise support requests, with organizations re-evaluating their perimeter security architectures. The incident is intensifying broader enterprise shifts toward zero-trust network access (ZTNA) architectures that eliminate reliance on single monolithic identity gateway controllers, distributing authentication verification across multiple independent micro-perimeters.

![Enterprise endpoint detection and cybersecurity threat monitoring console dashboard.](https://rkhynbcsbnkkcwgexzwg.supabase.co/storage/v1/object/public/media/api/1789709442298-wzw550-cisco-zero-day-identity-services-engine-active-exploitation-inside-2-f922d5bd4a.webp)
*Security operations centers are monitoring network perimeters and endpoint telemetry to detect anomalous authentication bypass attempts.*

Cyber insurance underwriters have also taken notice, with several leading risk assessment firms issuing advisory bulletins warning policyholders that failure to patch known exploited network infrastructure vulnerabilities within mandatory CISA deadlines could jeopardize insurance claim eligibility.

## What to watch next

Enterprises must verify that all instances of Cisco ISE running across their global environments are updated with the official Cisco patches or isolated behind strictly controlled bastion networks. Network security teams should inspect appliance file systems for anomalous scheduled tasks and review network access control rules for unauthorized modifications made prior to patch installation.

Federal cybersecurity agencies are preparing detailed threat intelligence briefings that will outline the specific indicators of compromise (IoCs) and post-exploitation tactics observed in the wild. Industry observers expect Cisco to conduct an extensive internal code security audit across its enterprise software portfolio to prevent similar deserialization vulnerabilities in future product releases.

## Sources

- [Cisco Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-2026) — Official security bulletin detailing CVE-2026-76460 vulnerability mechanics, affected versions, and patch remediation downloads.
- [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-ise-zero-day-exploited-in-attacks/) — Comprehensive reporting on in-the-wild exploitation, threat actor campaigns, and CISA federal patching directives.
- [SecurityWeek](https://www.securityweek.com/cisco-patches-actively-exploited-identity-services-engine-zero-day/) — In-depth enterprise security analysis covering identity perimeter risks, rootkit persistence techniques, and industry fallout.

Mentions: Cisco Systems, CISA, Apache Struts

## Sources
- [Cisco Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-2026)
- [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-ise-zero-day-exploited-in-attacks/)
- [SecurityWeek](https://www.securityweek.com/cisco-patches-actively-exploited-identity-services-engine-zero-day/)