CVE-2026-76460: Critical Cisco ISE Zero-Day Authentication Bypass Exploited in the Wild

Cisco disclosed CVE-2026-76460, a critical (CVSS 3.1 base score 10.0) authentication-bypass vulnerability in an ISE management API that allows unauthenticated remote attackers to bypass web management authentication and may lead to root command execution; Cisco confirmed active exploitation, CISA added the issue to the KEV catalog, and vendor emergency patches and detection/mitigation guidance (including IOCs and re-imaging recommendations) were released for affected 3.1–3.5 branches.