Cisco has added a critical authentication bypass flaw in its Identity Services Engine (ISE) to its Known Exploited Vulnerabilities catalog, with confirmed attacks already underway.

The vulnerability, tracked as CVE-2026-76460, carries a maximum CVSS score of 10.0 and affects ISE versions 3.1 through 3.5 and the ISE Passive Identity Connector. Cisco’s Product Security Incident Response Team confirmed active exploitation and urged immediate patching, noting attackers can achieve root-level access without authentication or user interaction.

Exploitation targets an API endpoint in ISE’s management interface, allowing unauthenticated remote attackers to bypass security controls. Successful breaches could enable deletion of forensic evidence, complicating incident response. Cisco recommends reviewing ISE access logs for anomalous usernames across all nodes and inspecting external network logs for unexpected data transfers.

If exploitation is detected, the company advises reimaging affected systems and restoring configurations from backups. While temporary mitigation is possible via infrastructure access control lists restricting management traffic, no permanent workaround exists. Permanent fixes are available in specific patch versions, with ISE 3.0 users required to migrate to supported releases.

The advisory follows another critical vulnerability, CVE-2026-76461, affecting Secure Email Gateway and Secure Email and Web Manager appliances, also under active attack. Both flaws received top CVSS ratings of 10.0, with the latter scoring 9.8.

Cisco discovered CVE-2026-76460 during technical support case resolution but has not disclosed attacker identities, attack duration, or post-exploitation activities. The company also published additional ISE vulnerabilities, including two other critical remote code execution flaws.

For network administrators managing Cisco infrastructure, the volume of patches released in September underscores heightened urgency in addressing these active threats.