Full Report
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker
Analysis Summary
# Morning News Roll-up September 17, 2026
## Overview
Cisco has released a massive security advisory addressing 77 vulnerabilities across its product portfolio. The most critical discovery is a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) that is currently being exploited in the wild to bypass authentication and gain root access.
## Top Stories
### Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0)
- Summary: Cisco ISE is facing active exploitation of CVE-2026-76460, a flaw in an API endpoint that allows unauthenticated remote attackers to bypass the web management interface and potentially gain root-level command execution.
- Source: hxxps://thehackernews[.]com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
### CISA Adds Cisco ISE Vulnerability to KEV Catalog
- Summary: Due to evidence of active exploitation, CISA has added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog, mandating that federal agencies apply patches by September 19, 2026.
- Source: hxxps://www[.]cisa[.]gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
### Critical Flaws Impacting Cisco Secure Email Gateway and Firewall
- Summary: Beyond ISE, Cisco confirmed active exploitation of a critical flaw in Secure Email Gateway (CVE-2026-76461) and issued dozens of patches for the Secure Firewall portfolio addressing RCE and SQL injection risks.
- Source: hxxps://thehackernews[.]com/2026/09/cisco-secure-email-gateway-flaw.html
---
# Cisco Identity Services Engine (ISE) Critical Auth Bypass
A maximum-severity zero-day vulnerability (CVE-2026-76460) has been identified in Cisco Identity Services Engine (ISE), allowing unauthenticated remote attackers to bypass authentication controls via a crafted API request.
## Key Points
- **Vulnerability:** CVE-2026-76460 (CVSS 10.0).
- **Impact:** Complete bypass of web-based management authentication, potentially leading to command execution with **root privileges**.
- **Exploitation Status:** Active "in-the-wild" exploitation confirmed by Cisco and CISA.
- **Log Evasion:** Attackers with root access may remove or hide evidence of exploitation and IoCs within the system logs.
## Threat Actors
- **Attribution:** Not currently available.
- **Motivations:** Likely espionage or high-level network access, given the targeting of identity and access management (IAM) infrastructure.
## TTPs
- **Access Method:** Sending crafted HTTP requests to a specific, vulnerable API endpoint.
- **Post-Exploitation:** Gaining unauthorized access to the web-based management interface; escalating to root-level shell access.
- **Evasion:** Cleaning or modifying system logs to obscure malicious activity.
## Affected Systems
- **Cisco Identity Services Engine (ISE):** Versions 3.1, 3.2, 3.3, 3.4, and 3.51.
- **Cisco ISE Passive Identity Connector (ISE-PIC):** All configurations affected.
## Mitigations
- **Immediate Patching:**
- 3.1: Upgrade to 3.1 Patch 12
- 3.2: Upgrade to 3.2 Patch 11
- 3.3: Upgrade to 3.3 Patch 12
- 3.4: Upgrade to 3.4 Patch 7
- 3.51: Upgrade to 3.5 Patch 4
- **Detection:** Run the following command to check for the "dummyuser" indicator in the access logs:
`show logging application ise-kong/access.log | include dummyuser`
- **Network Security:** Use Infrastructure Access Control Lists (iACLs) to restrict management plane traffic only to trusted IP addresses.
- **Recovery:** If exploitation is confirmed, Cisco recommends re-imaging the affected nodes and restoring from a known-good backup.
## Conclusion
This incident represents a severe risk to enterprise network integrity. Because Cisco ISE serves as the central "brain" for network access control, a root-level compromise allows attackers to manipulate authentication and authorization for the entire organization. Immediate patching and log auditing for the "dummyuser" string are mandatory for all administrators of Cisco ISE environments.