Cisco's Network Gatekeeper Had a Perfect 10 Hole in It

Cisco Identity Services Engine is the system a lot of large networks use to decide who gets in and who doesn't. Plug in a laptop, connect to Wi-Fi, join a VPN, and ISE is usually the thing quietly checking your identity before it lets you through. On 16 September 2026, Cisco admitted that gatekeeper had a hole in it big enough to walk a truck through.

The flaw, CVE-2026-76460, scores a full 10.0 on the CVSS scale, the maximum possible severity. It sits in an API endpoint with insufficient authentication control, meaning an attacker doesn't need a password, a token, or any foothold at all. Send the right request and you bypass login completely. From there, Cisco says successful exploitation hands the attacker command execution with root privileges, which is about as bad as it gets on a network appliance whose entire job is deciding who is trustworthy.

Cisco disclosed nine vulnerabilities in ISE that day as part of a broader hardening release, and this wasn't a theoretical one sitting in a lab. Cisco confirmed active exploitation in the wild before the patch was even public, and CISA moved fast, adding it straight to the Known Exploited Vulnerabilities catalogue with a hard deadline of 19 September 2026 for federal agencies to patch. There's no workaround here either. No config tweak, no firewall rule that neutralises it. The only fix is the patch itself.

Why it matters: ISE deployments tend to sit deep inside corporate networks, often trusted by everything around them, which makes an auth bypass here far more dangerous than the same bug in a random internet-facing app. An attacker who skips the front door on your identity system doesn't just get one account, they potentially get the keys to deciding who else gets to walk in behind them.

This is also the second time this year Cisco's network access control gear has made headlines for the wrong reasons. Enterprise security teams have spent the last few years pushing "zero trust" architectures that lean heavily on exactly this kind of identity infrastructure. When the infrastructure enforcing zero trust turns out to have a hole allowing zero authentication, it's a reminder that centralising trust in one system also centralises risk.

If you run ISE, or you manage a network where someone else does, the advice is blunt: patch now, don't wait for a maintenance window. Cisco's advisory (cisco-sa-hardening-ise-XU5EwX5T) has the fixed versions. Check your ISE admin interface isn't exposed to the wider internet while you're at it, since that's the most obvious way this gets exploited at scale. And if your organisation has any process for verifying whether attackers already got in before the patch landed, this is the week to run it, not skip it.

Read more: Cisco Security Advisory: ISE Hardening Release September 2026, The Register: Cisco drops another exploited zero-day, this time a perfect 10