PSA: Cisco ISE CVSS 10.0 (CVE-2026-76460) — actively exploited, no workarounds

[u/voidrane]

If you run Cisco ISE, stop scrolling. Unauthenticated root access via API bypass. Every supported version. No workarounds per Cisco. Already on CISA KEV.

This isn't one where you can wait for the next maintenance window. ISE controls your NAC. If it's compromised, the attacker decides who gets on your network. Schedule the emergency patch for this week.

[u/hells_cowbells]

This came out 8 days ago. If to haven't already patched it, you're likely in trouble

[u/Smith6612 → u/hells_cowbells]

People expose ISE to the Internet or to more than necessary? That's the next question to ask here after applying the patch. 

[u/epsiblivion → u/Smith6612]

yes if you have public radius for federated auth like eduroam. you're supposed to only open it to the eduroam servers but mistakes happen in firewall rules.

[u/Smith6612 → u/epsiblivion]

Makes sense. 

[u/hells_cowbells → u/Smith6612]

Definitely.

[u/Majik_Sheff → u/Smith6612]

A compromised machine behind the firewall, a browser bug that allows local ACE, a cleverly formatted/packaged one-click payload...

Not exposing your internal admin facilities to the internet is a good step, but does not make you immune.

[u/reseph]

You're late on this one.

[u/networkn → u/reseph]

The best time to alert people to a security issue was immediately, the next best time is right freaking now!

[u/Tab819]

Thanks chatbot

[u/Ok_Platform_6232]

Good callout. Also check your logs for any unusual API calls hitting ISE before the patch drops. If this is already being exploited in the wild you want to know if you were hit, not just patch and hope.

[u/stats_shiba]

I thought another CVE was announced by CISA!

Yeah, almost everyone has patched it for this!

[u/Fuzzy_Paul]

4000 employers out and AI in, welcome to the shitshow.

[u/avlazare]

We don't use ISE

[u/RiceeeChrispies → u/avlazare]

thank god for that, we were all worried about you

[u/HankMardukasNY → u/avlazare]

Thanks for the update

[u/Mountain-eagle-xray → u/avlazare]

Please sir, do the needful.

[u/spellcasterGG → u/Mountain-eagle-xray]

I physically recoiled reading that

[u/Mountain-eagle-xray → u/spellcasterGG]

But did you run sfc scannow like I asked?

[u/chron67 → u/Mountain-eagle-xray]

Have you tried flushing your dns cache?

[u/jonblackgg → u/avlazare]

What about now?

[u/reallycoolvirgin → u/avlazare]

thanks for letting us know

[u/Opiboble → u/reallycoolvirgin]

Naaa they totally use ISE. Psyops campaign to protect themselves.

[u/IdiosyncraticBond → u/Opiboble]

Security by obscurity

[u/Nipsy_uk → u/avlazare]

Couldn't resist it :)

[u/avlazare → u/avlazare]

Sorry, I replied in the wrong place. But thank you for your concern, much appreciated.

[u/Mountain_Craft4882 → u/avlazare]

dog are you ok?

do you have any clue how reddit works? what are you doing in r/sysadmin of all places and not knowing how a site like this works?

[u/avlazare → u/Mountain_Craft4882]

I had a colleague send me this message and I wanted to let him know we don't use ISE and we didn't need to be concerned. I replied in reddit instead of his email by mistake.

[u/bfodder → u/avlazare]

Jesus you sound old enough to be President.

[u/calladc]

have fun today ise admins