# Actively exploited Cisco ISE flaw CVE‑2026‑76460 allows CVSS 10 auth bypass with no workaround

*Thursday, September 17, 2026 at 8:05 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-09-17T08:05:43.897Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/18089.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A zero‑day vulnerability in Cisco Identity Services Engine, tracked as CVE‑2026‑76460, is under active exploitation as a CVSS 10.0 authentication bypass with no workaround, and can lead to root‑level command execution on affected systems.

Cisco has warned that a critical vulnerability in its Identity Services Engine (ISE) product is being exploited in the wild, turning a core access-control platform into a potential entry point for attackers.

The flaw, tracked as CVE‑2026‑76460, is described as a CVSS 10.0 authentication bypass that can allow successful attackers to execute commands with root privileges on affected systems. There is no workaround, according to a security advisory linked by The Hacker News.

Cisco ISE is widely used to control which users and devices can connect to enterprise networks and what they’re allowed to do once connected. If attackers can bypass authentication on ISE and gain root access, they can tamper with policies, alter which devices are treated as trusted and potentially move deeper into sensitive parts of an organization’s infrastructure.

The lack of a workaround means administrators can’t mitigate the issue by simply changing configuration settings or disabling a narrow feature. Organizations need to identify affected versions, apply vendor fixes as they become available and closely monitor their environments for signs of compromise.

For IT and security teams, this kind of zero‑day in a central security product forces rapid decisions about emergency maintenance, potential isolation of key systems and tighter access controls while patches are rolled out.

Key indicators to watch are Cisco’s release of software updates for all impacted ISE versions, guidance on how to detect successful exploitation and reports from security vendors on how widely attackers have used CVE‑2026‑76460 against corporate and government networks.