Cisco published an advisory on September 16 for CVE-2026-76460, an authentication bypass in Identity Services Engine that scores 10.0 on CVSS and is being exploited in the wild. The bug is in an API endpoint that doesn't check credentials. Send it the right request and you skip the management login. Cisco says an attacker who gets that far can end up with command execution as root.

One sentence in the advisory tells you how this went: "This vulnerability was found during the resolution of a Cisco Technical Assistance Center (TAC) support case." A customer opened a ticket. While working the ticket, Cisco found an attacker inside, using a hole Cisco didn't know it had. The vendor of the product learned about a flaw in its own authentication layer from a customer who had already been broken into.

ISE is the box that decides who gets on the network. It runs 802.1X, RADIUS and TACACS+ for switch ports, wireless and VPN in a lot of enterprises. Root on ISE is root over the access policy for everything behind it. The management interface is also where the integrations live, so the same box holds Active Directory service accounts, certificates and the credentials for every switch it manages.

Four perfect tens in one day

The zero-day landed on the same day as Cisco's scheduled hardening release, which publishes on the first and third Wednesday of each month. Cisco's advance notice listed 15 advisories for ISE alone, 13 for the Secure Firewall line (ASA, FTD and Management Center), and 3 more for Nexus Dashboard, BroadWorks and ThousandEyes. That is 31 advisories in one drop.

Inside the ISE batch there are three more bugs rated 10.0:

  • CVE-2026-20130, an injection flaw (CWE-74) in the hardening release, reachable from the network with no credentials.
  • CVE-2026-20192, improper access control (CWE-284) in the same release, same vector.
  • CVE-2026-76423, an authorization check missing from the REST API web service. Cisco says an unauthenticated attacker can "gain administrative access to an affected device."

Under those sit CVE-2026-20234 and CVE-2026-20237 at 9.9, and CVE-2026-20307 at 9.9, an insecure deserialization bug in the web management interface that takes an admin account with low privileges to root. Cisco credits outside researchers at REQON, TrendAI Research and STAR Labs for the three bugs in that RCE advisory. The rest came from inside Cisco.

Four CVSS 10 bugs on one product in one day, and the product's sole job is authentication. Cisco's PSIRT says it is not aware of exploitation of the other three. That statement is accurate as of Wednesday and will be stale soon. Public proof of concept for the 2025 ISE bugs appeared within weeks of disclosure, and the same API surface is in play here.

Cisco says its own AI found the rest

The ISE hardening advisory has a line I don't remember seeing from Cisco before: "These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models."

Read that as a signal about supply. Cisco pointed a model at an appliance it has shipped since 2011 and got two CVSS 10s and two 9.9s out of it in one review cycle. Attackers have the same models. Cisco does not say which ones. The hardening advisory doesn't say whether the exploited bug came out of that process either, and the wording of the zero-day advisory suggests it did not. The attacker found it first.

The 2025 history is the reason to take this cycle seriously. Cisco disclosed CVE-2025-20281 on June 25, 2025, a CVSS 10 unauthenticated root RCE in an ISE API, then split off CVE-2025-20337 as a second exploit path. Trend Micro's Zero Day Initiative saw exploitation on July 17, and Cisco confirmed it on July 22. Fixes were 3.3 Patch 7 and 3.4 Patch 2. Fourteen months later, we are at 3.3 Patch 12 and 3.4 Patch 7, and the same product has a new unauthenticated path to root through an API. That is a pattern.

Cisco also had a second exploited zero-day the same week. CVE-2026-76461 is a SQL injection in AsyncOS on Secure Email Gateway, rated 9.8, triggered by sending a crafted email through the appliance, and it gives root. Help Net Security covered the patch on September 15. CISA gave federal agencies until September 17 for that one and until September 19 for the ISE bug. Three days, for the server that authenticates the network.

Patch order if you run ISE

There is no workaround. Cisco says so in plain words. The fixed releases are:

  • 3.1 Patch 12
  • 3.2 Patch 11
  • 3.3 Patch 12
  • 3.4 Patch 7
  • 3.5 Patch 4

ISE 3.0 and older are end of life and don't get a patch. If you are still on 3.0 you are doing a version migration this week, not a patch install. Note that 3.5 Patch 3 fixes CVE-2026-20307 but not the exploited bug or CVE-2026-76423. You need Patch 4.

Until the patch is on, Cisco's only mitigation is infrastructure ACLs that restrict which sources can reach the management and control plane. If your ISE admin portal answers on a routable address, that is the first thing to change, and it should have been changed before this week. The Register's Carly Page notes Cisco's advice to reimage any node where exploitation is suspected, because root access is enough to delete the evidence.

Before you patch, look. Cisco's detection guidance is to check the Kong API gateway access log for usernames you don't recognize:

admin# show logging application ise-kong/access.log | include dummyuser

Swap in whatever names you'd expect and grep for what's left. Cross that against your firewall logs for transfers out of the ISE nodes that you can't explain. If either turns something up, the patch is not the fix. Reimage from a known image, rotate the AD service account and every TACACS+ and RADIUS shared secret, and reissue the certificates ISE holds. All of that is worse than a patch window, which is the point of doing the check first.

I've run infrastructure for 25 years, and the boxes that hurt most when they fall are the ones everything else trusts. A NAC server is the top of that list. Vendors sell these appliances as the thing you put in front of your network so the rest can be less careful. When the appliance ships four unauthenticated paths to root in one day, and learned about one of them from a victim, the careful part moves back to you. Keep the management plane off the routable network. Patch on the day. And expect the next Cisco hardening release on October 7 to bring more tens, because the model that found this batch hasn't stopped reading the code.