Cisco issues emergency patch for ISE zero-day under active exploitation

Cisco has released an emergency security update for a critical zero-day vulnerability in its Identity Services Engine (ISE) platform, tracked as CVE-2026-76460. SecurityWeek reports that the flaw allows remote, unauthenticated attackers to bypass authentication by sending specially crafted requests to vulnerable systems. Cisco confirmed that the vulnerability is being actively exploited in the wild, prompting the company to issue an out-of-band patch ahead of its normal release schedule. The Identity Services Engine is widely used across enterprise networks to manage network access control, device profiling, and policy enforcement, making it a high-value target for attackers seeking to gain persistent access to corporate infrastructure. CISA has also added the vulnerability to its Known Exploited Vulnerabilities catalogue, signalling that US federal agencies are required to patch affected systems within a mandated timeframe.

Why this matters for UK organisations

The operational risk here is significant for any UK organisation using Cisco ISE. The platform sits at a critical point in network security architecture, controlling who and what can access the network. A successful exploit could allow an attacker to bypass authentication entirely, effectively opening the door to the internal network without needing valid credentials. For organisations that rely on ISE as a core component of their zero-trust or network access control strategy, this vulnerability undermines a foundational security control. The fact that active exploitation is already confirmed means this is not a theoretical risk but an immediate operational concern. Organisations should treat this as a priority patching activity and ensure that any ISE deployments are updated as soon as operationally feasible. This is also a reminder that critical infrastructure components require clear ownership, rapid patching processes, and the ability to respond quickly when zero-day vulnerabilities emerge.

What to review

Security teams should identify all Cisco Identity Services Engine deployments across the organisation and apply the emergency patch as a priority. Organisations should also review access logs for any signs of suspicious authentication activity or unusual access patterns that may indicate attempted or successful exploitation. This is a prompt to ensure that patching processes for critical infrastructure components are clearly defined, well-rehearsed, and capable of being executed quickly when zero-day vulnerabilities are disclosed. Organisations should also review whether responsibility for maintaining and monitoring ISE deployments is clearly assigned and whether appropriate alerting and monitoring is in place to detect anomalous activity. For organisations that rely on ISE as a core security control, this is an opportunity to review whether compensating controls are in place and whether the organisation has sufficient visibility into authentication and access activity.

Source: SecurityWeek