Ethical Hacking News
Cisco has dropped another exploited zero-day, with the latest one being a perfect 10, revealing a critical authentication bypass vulnerability in the company's Identity Services Engine (ISE). The vulnerability, identified as CVE-2026-76460, has been actively exploited by attackers, giving them command execution with root privileges. This latest vulnerability is the second zero-day disclosed by Cisco in a short period of time, leaving administrators scrambling to patch their systems before the vulnerability can cause further damage. For administrators responsible for Cisco kit, September is shaping up to be quite the patching month.
Cisco has disclosed a critical zero-day vulnerability in its Identity Services Engine (ISE) that allows attackers to bypass authentication and execute command with root privileges.The vulnerability, CVE-2026-76460, has a maximum CVSS score of 10.0, indicating its severity.Administrators are advised to patch their systems immediately and review access logs for suspicious activity.No workaround exists, but Cisco recommends using infrastructure access control lists to restrict management traffic.Persistent fixes are available in ISE and ISE-PIC 3.1 Patch 12, 3.2 Patch 11, and 3.3 Patch 12.The incident highlights the importance of timely patching, proactive cybersecurity measures, and ongoing vigilance in the face of evolving threats.
Cisco has dropped another exploited zero-day, with the latest one being a perfect 10, revealing a critical authentication bypass vulnerability in the company's Identity Services Engine (ISE). The vulnerability, identified as CVE-2026-76460, has been actively exploited by attackers, giving them command execution with root privileges. This latest vulnerability is the second zero-day disclosed by Cisco in a short period of time, leaving administrators scrambling to patch their systems before the vulnerability can cause further damage.
Cisco disclosed the vulnerability on Wednesday, along with other ISE vulnerabilities, in an advisory that warned customers to install the fixes immediately. The advisory accompanied a substantial batch of other ISE advisories, including two others with maximum CVSS scores of 10.0 and a trio of remote code execution flaws with scores as high as 9.9. These advisories highlight the significant security concerns faced by Cisco users.
The vulnerability in CVE-2026-76460 is an API within Cisco ISE, the company's network access control platform. The flaw lies in insufficient authentication controls on an API endpoint, allowing an attacker to bypass the product's web-based management interface without requiring any credentials or user interaction. The maximum CVSS score of 10.0 underscores the severity of the vulnerability, as it can lead to root access, allowing attackers to remove or conceal traces of an intrusion, complicating efforts to determine whether an appliance had been breached.
Cisco advised administrators to review ISE access logs for suspicious usernames on every node in a distributed deployment and to check network and firewall logs held outside the affected device for signs of unexpected uploads or downloads. If administrators find evidence of possible exploitation, Cisco "strongly recommends" reimaging affected nodes and restoring their configurations from backup if necessary. No workaround exists, although Cisco said infrastructure access control lists can be used as a temporary mitigation to restrict management and control-plane traffic reaching affected systems.
Permanent fixes are available in ISE and ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. ISE 3.0 has reached the end of software maintenance, so customers running it must migrate to a supported release. The advisory is a stark reminder of the importance of timely patching and the need for organizations to prioritize their cybersecurity posture.
The vulnerability in CVE-2026-76460 is just the latest example of Cisco's struggle to keep up with the rapidly evolving threat landscape. The company has faced intense scrutiny in recent months, with multiple zero-days and critical vulnerabilities being disclosed. This has left many organizations scrambling to patch their systems and protect themselves from potential attacks.
The incident highlights the ongoing cat-and-mouse game between attackers and cybersecurity professionals. As attackers continue to push the boundaries of what is possible, cybersecurity professionals must remain vigilant and proactive in their efforts to stay one step ahead. The vulnerability in CVE-2026-76460 serves as a stark reminder of the importance of staying informed and up-to-date on the latest security patches and advisories.
In conclusion, the vulnerability in CVE-2026-76460 is a critical reminder of the ongoing security challenges faced by organizations and individuals. It highlights the importance of timely patching, proactive cybersecurity measures, and ongoing vigilance in the face of evolving threats. As the threat landscape continues to evolve, it is essential that individuals and organizations prioritize their cybersecurity posture and remain informed about the latest security patches and advisories.
Related Information:
https://www.ethicalhackingnews.com/articles/Cisco-Drops-Another-Exploited-Zero-Day-This-Time-a-Perfect-10-Exposing-ISE-Authentication-Bypass-Vulnerabilities-ehn.shtml
https://www.theregister.com/security/2026/09/17/cisco-drops-another-exploited-zero-day-this-time-a-perfect-10/5297180
Published: Thu Sep 17 09:25:24 2026 by llama3.2 3B Q4_K_M
