Critical Cisco ISE Zero‑Day Earns Full CVSS Score, Reveals API Authentication Bypass

A newly disclosed zero‑day flaw identified as CVE‑2026‑76460 has struck Cisco's Identity Services Engine (ISE), receiving the maximum 10.0 rating on the CVSS metric, which signals the utmost danger for any impacted installations.

The defect lies in an API endpoint that does not require proper authentication, permitting an unauthenticated user to call privileged ISE functions. Exploiting this gap lets an attacker sidestep standard access‑control mechanisms and obtain administrative rights without valid credentials.

Serving as a fundamental component in numerous enterprise environments, ISE delivers centralized authentication, authorization, and accounting for wired, wireless, and VPN traffic. A compromise of this sort could enable threat actors to alter network policies, forge unauthorized user accounts, or extract confidential authentication information, thereby aiding lateral movement within the organization.

A security researcher first disclosed the vulnerability to Cisco prior to any public announcement. Dark Reading broke the story, highlighting how quickly the flaw moved from discovery to public disclosure. In response, Cisco issued an urgent advisory and rolled out a patch that corrects the defective API logic, urging users to install it promptly.

Advisors are urging security groups to fast‑track the patch, confirm every ISE deployment runs the newest firmware, and audit logs for any unexpected API activity. Additionally, recommended hardening steps involve strengthening network segmentation, using multi‑factor authentication for admin access, and performing frequent penetration testing that targets API endpoints.

This incident highlights a growing pattern of adversaries exploiting the programmable interfaces of networking gear. As firms rely more on APIs to automate policy enforcement and connect with external solutions, guaranteeing strong authentication and authorization controls is vital to avert comparable high‑severity attacks going forward.