The controller that decides who enters the corporate network just received the maximum severity the scale allows, with exploitation happening while the patch was being published.
CVE-2026-76460, in Cisco Identity Services Engine (ISE) and ISE-PIC, is a remote, credentialless authentication bypass exploitable with a single API call, scoring CVSS 10.0. Cisco’s official advisory landed September 16, 2026, confirmed active exploitation, and affected all supported releases.
The asset that becomes the network
ISE is a NAC: it decides who and what connects to the corporate network, with policies per user, device, and posture. It runs no application, holds no customer data, and never appears in traffic reports. That is exactly why it usually drops off the patching and monitoring radar.
The problem is position, not function: ISE sits at the network’s entry bottleneck. Whoever controls the controller does not need to break anything: they grant themselves access. The disclosed flaw granted full administrative control, including root across the platform’s personas, with a single unauthenticated call. The attacker did not beat the front door: they became the doorman.
It is the same pattern as the Jack Henry case: the environment’s most critical asset gets the least attention, because nobody runs applications on it.
CVSS 10 with active exploitation: the priority ruler
Two signals, alone, already pull patching to the top of the cycle. Together, they turn the cycle into an emergency:
- CVSS 10.0: total impact and trivial exploitation, no user interaction, no credential. There is no "assess impact" window: the impact is the worst the scale describes.
- Confirmed active exploitation: CISA added the CVE to the KEV catalog, with a days-long deadline for federal agencies to patch. Active exploitation means the race is not against the researcher who disclosed, it is against whoever is already using it.
And the flaw’s design makes it worse: a bypass via API "regardless of configuration". The answer "my ISE is configured correctly" is not a defense here.
What to do now
For anyone operating ISE (or any NAC), the sequence is:
- Inventory and expose the minimum: management and APIs off the internet, access from the administration segment only.
- Patch as a perimeter emergency, not as a monthly-cycle item.
- Assume compromise if it was exposed: re-image as guidance recommends, rotate credentials, review admin accounts and access granted in the window.
- Treat the controller as critical production: telemetry, configuration-change alerts, periodic admin reviews.
And the structural lesson: segmentation and zero trust design limit the damage of a compromised controller. The compromised NAC still has to reach the rest of the network for damage to be total, and the network that prevents it is the one surviving its worst day.
Conclusion
A CVSS 10 zero-day in the identity controller is this year’s reminder (September, this time) that network security has a bottleneck, and the bottleneck runs software.
Access-controller patching is perimeter patching, and monitoring the NAC is monitoring who enters. This week’s inventory: where is your ISE, what version, and who else can decide who enters your network. If the answer to the third question is "I don’t know", September’s CVE already answered it for you.