GoKawiilCisco this week disclosed a slew of critical security vulnerabilities impacting its Identity Services Engine (ISE), including a maximum-severity zero-day flaw that's under exploitation.
CVE-2026-76460 is an authentication bypass vulnerability impacting an API in ISE, Cisco's network access control and zero-trust solution. According to the company, the flaw stems from "insufficient authentication control" on an ISE API endpoint.
"An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint," Cisco said in its advisory. "A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface."
The bug was disclosed and patched on Wednesday, and the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the same day. Cisco also disclosed and patched several other bugs impacting ISE and ISE Passive Identity Connector (ISE-PIC) that have similar API authentication issues.
Related:MFA Won't Save You From OAuth Consent Abuse
It's unclear who is exploiting CVE-2026-76460 and how extensive the activity is. (Dark Reading contacted Cisco for comment, but the company did not respond at press time.) But the zero-day attacks illustrate a trend of API authentication issues for the networking giant, as well as beyond.
"Missing authentication for API endpoints is an industry-wide problem," Johannes Ullrich, founder of the SANS Internet Storm Center, tells Dark Reading. In theory, each request to an API endpoint should be properly authenticated and access-controlled. However, that doesn't always happen.
"In some cases, APIs that were not directly reachable in the past are exposed, and in the process, proper authentication and access control are skipped," Ullrich says. "This easily happens as more extensive APIs are exposed to support more modern web application interfaces."
ISE Zero-Day Puts Entire Network at Risk
CVE-2026-76460 is particularly dangerous for several reasons. First, successful exploitation allows an attacker to gain root privileges and command execution on vulnerable instances, with no authentication or user interaction required.
... continue reading