:quality(90):no_upscale()){kind=logo}
Cisco's Identity Services Engine Vulnerability: The Platform That Controls Network Access Became the Way Attackers Got In
STATUS: Actively Exploited Zero-Day SEVERITY: 7/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Oct 12, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
A flaw in Cisco's Identity Services Engine, the platform responsible for deciding which devices and users get access to a network, let attackers bypass that decision entirely and gain the same root-level trust the platform is built to enforce. Cisco has confirmed real customers were already compromised before a patch existed, with no way to reduce the risk in the meantime.
What Happened
The system built to decide who gets onto the network became the attack vector.
Cisco Identity Services Engine, or ISE, is the platform many government and enterprise networks rely on to enforce 802.1X and RADIUS policy, the rules that decide which devices and users are allowed to connect and what they're allowed to reach once they do.1 A vulnerability disclosed this month, CVE-2026-76460, let an unauthenticated remote attacker bypass that enforcement entirely and gain root-level control of the platform itself.1,2 That access carried the same trust the network had delegated to ISE for every connected device and user. This was not a compromise confined to a single endpoint.
Cisco's security team said it discovered the active exploitation through a customer support case, meaning real organizations were already compromised before Cisco had a patch ready to distribute.3 Once inside, an attacker with root privileges could alter or erase the platform's own logs, removing the evidence a security team would normally rely on to detect and investigate the intrusion.2 Cisco confirmed no workaround exists for organizations that can't immediately patch. The only path to reducing risk is completing the upgrade.1
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026, giving federal civilian agencies a three-day window to patch, and the disclosure arrived one day after Cisco confirmed a separate actively exploited flaw in its Secure Email Gateway.1,4 Two actively exploited, maximum- or near-maximum-severity flaws in core infrastructure within 48 hours should prompt a broader question. How much of an organization's security posture depends on trusting a small number of high-privilege systems to police themselves correctly, without independent verification?
This also isn't an isolated event for ISE specifically. The platform has now taken a maximum-severity hit in back-to-back years, with two separate CVSS 10.0 vulnerabilities disclosed in 2025 and nine more vulnerabilities, three of them critical, bundled into this single release.4 A platform that repeatedly earns the internet's highest severity score is not a platform whose access decisions should be trusted without an independent way to verify them.
What They Found
Finding | What It Means | Operational Consequence | Open Question |
The vulnerability let an attacker bypass Cisco ISE's access-control enforcement entirely and gain the same root-level trust the platform normally grants only after verifying a device or user. | Access control is only as strong as the platform enforcing it, and when that platform itself can be bypassed, every downstream access decision it made is suspect. | Organizations can't treat “the device passed network access control” as proof of anything once the control point itself has been shown to be bypassable. | How would a security team know if a device gained access through this bypass rather than through Cisco's normal verification process, without a separate, independent record to check against? |
Successful exploitation gave attackers root-level access, including the ability to alter or erase the platform's own logs. | The system organizations would normally check to understand what happened during an incident could not be trusted as evidence in this specific compromise. | Incident response can't rely solely on the compromised system's own records, and needs an independent source of truth about which devices actually had access and when. | Do affected organizations maintain access and compliance records outside the access-control platform itself, so an investigation doesn't depend entirely on a system an attacker may have already altered? |
This is the second consecutive year Cisco ISE has taken a maximum-severity vulnerability, and this release alone bundled nine ISE flaws, three of them critical. | A single platform enforcing access control for an entire network is a recurring target, not a one-time patching concern. | Organizations that verify access and compliance only through the platform being targeted have no independent check when that platform is the thing that's compromised. | Would continuous, independent device compliance verification have shortened the time between compromise and detection in this specific case? |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
Once a device or user passes network access control, that access can be trusted for the duration of the session without further verification. | The platform performing that verification can itself be bypassed entirely, meaning a device could gain access without ever legitimately passing the check organizations assume it passed. | BlackBerry® UEM verifies device compliance on an ongoing basis rather than treating a single access-control decision as permanent, so a device's standing is continuously reassessed rather than trusted indefinitely after one check. |
The access-control platform's own logs are a reliable record of what happened on the network. | Root-level exploitation of ISE gave attackers the ability to alter or erase those logs, removing the evidence a security team would normally investigate first. | Independent, continuous compliance monitoring keeps a record of device status outside the access-control platform itself, so an investigation isn't limited to evidence an attacker may have already had the ability to erase. |
A three-day patch window is sufficient response time for a critical access-control vulnerability. | Cisco confirmed attackers were already exploiting the flaw before the patch existed, meaning real exposure began well before any compliance deadline started counting. | Ongoing access verification flags a high-risk, unpatched system immediately as conditions change, rather than waiting for a scheduled scan or an external deadline to surface what's already a live risk. |
Recommended Actions
IMMEDIATE | Confirm every Cisco ISE and ISE-PIC instance is upgraded to a fixed release and treat any instance that was internet-reachable and unpatched before September 16 as a potential compromise, not a routine missed patch. |
IMMEDIATE | Cross-check ISE's own access logs against an independent record of device and user activity, since root-level exploitation included the ability to tamper with the platform's logs. |
SHORT-TERM | Reduce reliance on any single access-control platform as the sole source of truth for who is on the network and establish an independent verification layer. |
SHORT-TERM | Move device compliance and access verification to a continuous model rather than a point-in-time check performed once at connection. |
ONGOING | Track how often the access-control and identity platforms your organization depends on require emergency patching and treat a recurring pattern as a signal to add independent verification, not just to patch faster. |
Security Must Follow the Full Device Stack
Access control works by concentrating trust in a small number of systems built to make that decision correctly every time. That concentration is also what makes those systems worth attacking: compromise the platform making the decision, and every device it has ever approved becomes suspect at once. A security posture that depends entirely on one system verifying itself has no way to detect when that system itself has been compromised. Ongoing, independent verification of device compliance and access exists precisely for that moment, catching what the access-control system itself can no longer be trusted to report.
Citations:
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
(The Hacker News, coverage of CVE-2026-76460, September 17, 2026).
Active Exploitation of Vulnerability in Cisco Identity Services Engine (Cyber Security Agency of Singapore, advisory on active exploitation of the Cisco ISE vulnerability, September 21, 2026).
Cisco drops another exploited zero-day, this time a perfect 10 (The Register, coverage of Cisco's back-to-back zero-day disclosures, September 17,2026).
Cisco Patches Perfect-10 ISE Zero-Day, 9 Bugs [2026] (Tech Insider, analysis of CVE-2026-76460 and Cisco ISE's vulnerability history, September 22, 2026).
:quality(90):no_upscale())