Cisco Patches Max-Severity ISE Flaw, the Second Critical Zero-Day This Week

Cisco alerts customers to second actively exploited zero-day in as many days

The latest zero-day has a maximum-severity rating and affects Cisco Identity Services Engine, a product hit with three actively exploited vulnerabilities since June 2025.

Cisco patches max-severity ISE flaw, the second critical zero-day this week

Cisco released patches for an actively exploited authentication bypass vulnerability in its Cisco Identity Services Engine (ISE) platform, which is used for enterprise network access control and policy enforcement. This is the second zero-day flaw Cisco has been forced to release emergency patches for this week, after fixing a critical vulnerability in its Secure Email Gateway appliance. The Cisco ISE flaw, tracked as CVE-2026-76460, has the max…

Cisco hit by max severity zero-day exploit targeting Identity Services Engine, so it's time to patch up

Both Cisco and CISA are warning about in-the-wild abuse.

Cisco drops another exploited zero-day, this time a perfect 10

Cisco admins who have spent their week patching email gateways now face a perfect-10 Identity Services Engine flaw under active attack. Cisco disclosed CVE-2026-76460 on Wednesday, describing it as an authentication bypass affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Successful exploitation can give an unauthenticated remote attacker command execution with root privileges. Product Security Incident Respo…

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild.

Cisco Patches Perfect-10 ISE Flaw Already Under Attack Before Anyone Knew

Cisco disclosed CVE-2026-76460, a CVSS 10.0 authentication bypass in its Identity Services Engine that lets unauthenticated attackers gain root access with a single crafted request. CISA confirmed active exploitation and gave federal agencies until September 19, 2026 to patch, with no workaround available beyond restricting network access.