Cisco has issued a warning about a new maximum-severity security flaw affecting the Identity Services Engine (ISE). This vulnerability, identified as CVE-2026-76460 (CVSS score: 10.0), could enable an unauthenticated, remote attacker to circumvent authentication. It has been resolved in the following versions: - 3.1 - Fixed in 3.1 Patch 12 - 3.2 - Fixed in 3.2 Patch 11 - 3.3 - Fixed in 3.3 Patch 12 - 3.4 - Fixed in 3.4 Patch 7 - 3.51 - Fixed in 3.5 Patch 4 Cisco is urging users to scrutinize the "access.log" file for any suspicious usernames.
However, customers can mitigate the risk by using infrastructure access control lists (iACLs) to allow only the necessary management and control plane traffic destined to the affected device.
On September 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included CVE-2026-76460 in its Known Exploited Vulnerabilities (KEV) catalog, necessitating Federal Civilian Executive Branch (FCEB) agencies to implement patches by September 19, 2026.
