buildOne report1 publisher Cisco patches a CVSS 10.0 ISE bypass that reaches root through its gateway-fronted management API
Cisco rated a flaw in Identity Services Engine's management API CVSS 10.0 because one crafted, unauthenticated request could reach root. A dev.to analysis traces the likely gap to route coverage in the Kong-derived gateway that authenticates the API, a risk any proxy-authenticated service shares.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence55
CVE-2026-76460 scores a CVSS 10.0, affects Cisco ISE and ISE-PIC in every configuration, and has no workaround. CISA added it to the KEV catalog the day the patches shipped and gave federal agencies three days.
Perspective Coverage
10 publishers
- Builder
- Builder 16%
- Operator
- Operator 74%
- Investor
- Investor 10%
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence80
buildOne report1 publisher Exploited Cisco ISE flaw gives unauthenticated attackers root on the node that grants network access
Cisco confirmed attackers are exploiting CVE-2026-76460, a CVSS 10.0 flaw giving unauthenticated root on Identity Services Engine. ISE decides which devices join the network, so a rooted node hands over every access decision and the device credentials it stores.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher F5 and Cisco report live exploitation in two of the three security products Canada's Cyber Centre flagged
F5 and Cisco say attackers are exploiting flaws in BIG-IP APM and ISE, two of the three security products in Canada's September 2026 Cyber Centre alerts. Three alerts are too few to show a trend in attacker targeting, but the two exploited products need fixed software now.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence50
Eclypsium finds the month's exploited infrastructure flaws again in the management consoles
Eclypsium tracked 158 infrastructure advisories between August 25 and September 17. The exploited maximum-severity flaws it highlights are authentication bypasses in Cisco's Firewall Management Center and Identity Services Engine.
Reality
- Evidence62
- Adoption72
- Hype gap+14
- Incentives65
- Confidence58
Attackers are bypassing authentication on Cisco ISE with a crafted API request
Cisco says CVE-2026-76460 is under active exploitation. It scores 10.0, needs no credentials, and puts an unauthenticated attacker past the web management interface of an Identity Services Engine appliance.
Reality
- Evidence45
- Adoption30
- Hype gap−10
- Incentives50
- Confidence48
Attackers hit Cisco's email gateway with a SQL injection zero-day before the patch shipped
CVE-2026-76461 is one of three flaws confirmed under active attack in a single week. Revolut's customer records left by a different route, a request sent from an email address on a government agency's own domain.
Reality
- Evidence42
- Adoption62
- Hype gap+12
- Incentives58
- Confidence47
buildConfirmed2 publishers Cisco's PSIRT says CVE-2026-76460 is being exploited, and the company has published no workaround, so the fix is a branch-specific patch. ISE 3.0 is past End of Software Maintenance and gets a migration.
Reality
- Evidence72
- Adoption42
- Hype gap+6
- Incentives38
- Confidence68
buildOne report1 publisher A crafted HTTP request runs commands as root on unpatched Cisco ISE nodes
Cisco and CISA confirm CVE-2026-76460 is being exploited in the wild. The flaw sits in the ISE and ISE-PIC management API, scores 10.0, and affects vulnerable releases whatever optional features are turned on.
Reality
- Evidence62
- Adoption52
- Hype gap0
- Incentives30
- Confidence58