INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Cisco Exploited Zero-Day ISE Auth Flaw via Active Attacks

| 2026-09-17 11:15 CRITICAL HIGH EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
Cisco this week disclosed a slew of critical security vulnerabilities impacting its Identity Services Engine (ISE), including a maximum-severity zero-day flaw that's under exploitation. CVE-2026-76460 is an authentication bypass vulnerability impacting an API in ISE , Cisco's network access control and zero-trust solution. According to the company, the flaw stems from "insufficient authentication control" on an ISE API endpoint. "An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint," Cisco said in its advisory .
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-20129, CVE-2026-76424 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
domains 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-20129CVE-2026-20129 CVE-2026-76424CVE-2026-76424 CVE-2026-20283CVE-2026-20283 CVE-2026-20340CVE-2026-20340 CVE-2026-20324CVE-2026-20324 CVE-2026-76409CVE-2026-76409 CVE-2026-20331CVE-2026-20331 CVE-2026-76427CVE-2026-76427 CVE-2026-20223CVE-2026-20223 CVE-2026-20322CVE-2026-20322 CVE-2026-20335CVE-2026-20335 CVE-2026-20307CVE-2026-20307 CVE-2026-20334CVE-2026-20334 CVE-2026-20192CVE-2026-20192 CVE-2026-20242CVE-2026-20242 CVE-2026-20333CVE-2026-20333 CVE-2026-20211CVE-2026-20211 CVE-2026-20342CVE-2026-20342 CVE-2026-76442CVE-2026-76442 CVE-2026-20284CVE-2026-20284 CVE-2026-76412CVE-2026-76412 CVE-2026-20353CVE-2026-20353 CVE-2026-76420CVE-2026-76420 CVE-2026-20237CVE-2026-20237 CVE-2026-20176CVE-2026-20176 CVE-2026-20344CVE-2026-20344 CVE-2026-20341CVE-2026-20341 CVE-2026-20194CVE-2026-20194 CVE-2026-76460CVE-2026-76460 CVE-2026-20326CVE-2026-20326 CVE-2026-76441CVE-2026-76441 CVE-2026-20336CVE-2026-20336 CVE-2026-20287CVE-2026-20287 CVE-2026-76426CVE-2026-76426 CVE-2026-20361CVE-2026-20361 CVE-2026-20332CVE-2026-20332 CVE-2026-20360CVE-2026-20360 CVE-2026-76440CVE-2026-76440 CVE-2026-20234CVE-2026-20234 CVE-2026-20130CVE-2026-20130 CVE-2026-20305CVE-2026-20305 CVE-2026-76428CVE-2026-76428 CVE-2026-20343CVE-2026-20343 CVE-2026-76425CVE-2026-76425 CVE-2026-76443CVE-2026-76443 CVE-2026-20329CVE-2026-20329 CVE-2026-20325CVE-2026-20325 CVE-2026-20330CVE-2026-20330 CVE-2026-76413CVE-2026-76413 CVE-2026-20306CVE-2026-20306 CVE-2026-20282CVE-2026-20282 CVE-2026-76461CVE-2026-76461 CVE-2026-76423CVE-2026-76423
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎September 16
A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface,” Cisco wrote in its update dated September 16.
‎September 16, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026.
vulnerability CVE-2026-76460
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution Known Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
tactic T1588.006 - Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution Federal Civilian Executive Branch
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution FCEB
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
‎Sep 17, 2026
General Document Context.
‎2026/09/17
Threat actors are actively exploiting a critical authentication bypass vulnerability in Cisco's Identity Services Engine (ISE) tracked as CVE-2026-76460.
organisation API
The flaw, CVE-2026-76460 , is due to insufficient control on an API endpoint.
"This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said.
infrastructure Windows
Related: Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit Mitigating CVE-2026-76460 Exploitation CVE-2026-76460 affects ISE and ISE-PIC, regardless of device configuration.
organisation Cisco Identity Services Engine
Cisco has warned customers of the active exploitation of a maximum severity flaw affecting its Cisco Identity Services Engine (ISE) product.
organisation Cisco ISE
The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
" The issue affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
organisation Cisco ISE Passive Identity Connector
The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
" The issue affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
organisation Cisco Customers Told
Cisco Customers Told to Check for Signs of Exploitation Cisco also recommended that ISE customers look for indicators of attempted exploitation of the vulnerability.
organisation IP
This includes unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.
infrastructure 9.9
CVE-2026-20329 (CVSS score: 9.9), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC)…
CVE-2026-20324 (CVSS score: 9.9) - A vulnerability in the sftunnel inter-device communication protocol of FMC Software that could allow an authenticated, remote attacker to execute arbitrary commands as root.
infrastructure 9.6
CVE-2026-20329 (CVSS score: 9.9), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC)…
infrastructure 9.0
CVE-2026-20329 (CVSS score: 9.9), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC)…
CVE-2026-76412, CVE-2026-76413, CVE-2026-76420 (CVSS score: 9.0) - Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software that could allow a remote attacker to gain root access and perform session forgery or session impersonation.
organisation CVE-2026-20324
CVE-2026-20324 (CVSS score: 9.9) - A vulnerability in the sftunnel inter-device communication protocol of FMC Software that could allow an authenticated, remote attacker to execute arbitrary commands as root.
organisation CVE-2026-76413
CVE-2026-76412, CVE-2026-76413, CVE-2026-76420 (CVSS score: 9.0) - Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software that could allow a remote attacker to gain root access and perform session forgery or session impersonation.
infrastructure 9.0 Multiple vulnerabilities
CVE-2026-76412, CVE-2026-76413, CVE-2026-76420 (CVSS score: 9.0) - Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software that could allow a remote attacker to gain root access and perform session forgery or session impersonation.
organisation Cisco Secure Firewall Adaptive Security Appliance
…), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software that are grouped by CW…
infrastructure 9.8
Software for Cisco Secure Email Gateway ( CVE-2026-76461 , CVSS score: 9.8) has come under active exploitation in the wild.
CVE-2026-20242 (CVSS score: 9.8) - A vulnerability in the External Database Access feature of FMC Software that could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device.
organisation Cisco Secure Email Gateway
Software for Cisco Secure Email Gateway ( CVE-2026-76461 , CVSS score: 9.8) has come under active exploitation in the wild.
organisation CVSS
Software for Cisco Secure Email Gateway ( CVE-2026-76461 , CVSS score: 9.8) has come under active exploitation in the wild.
infrastructure 9.1
CVE-2026-20340, CVE-2026-20341 (CVSS score: 9.1), CVE-2026-20342, CVE-2026-20343, CVE-2026-20344 - Multiple vulnerabilities in FMC Software that could allow a remote attacker to gain root access, download sensitive files, perform a SQL injection attack, or cause a denial-of-service (DoS) condition.
organisation DoS
CVE-2026-20340, CVE-2026-20341 (CVSS score: 9.1), CVE-2026-20342, CVE-2026-20343, CVE-2026-20344 - Multiple vulnerabilities in FMC Software that could allow a remote attacker to gain root access, download sensitive files, perform a SQL injection attack, or cause a denial-of-service (DoS) condition.
organisation the External Database Access
CVE-2026-20242 (CVSS score: 9.8) - A vulnerability in the External Database Access feature of FMC Software that could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device.
organisation Cisco Secure Firewall Threat Defense
….6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software that are grouped by CWE category, covering areas like improper handling of exceptional c…
organisation Cisco Secure Firewall Management Center
…VE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software that are grouped by CWE category, covering areas like improper handling of exceptional conditions, improper access control, improper adherence t…
organisation CWE
…n Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software that are grouped by CWE category, covering areas like improper handling of exceptional conditions, improper access control, improper adherence to coding standards, and improper control of a resource through its lifetime…
infrastructure 9.1 Multiple vulnerabilities
A brief description of the flaws is below - CVE-2026-20176 (CVSS score: 9.9), CVE-2026-20211 (CVSS score: 9.1), CVE-2026-20307 (CVSS score: 9.1) - Multiple vulnerabilities in ISE that could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.
CVE-2026-20305 (CVSS score: 9.1), CVE-2026-20306 (CVSS score: 9.1) - Multiple vulnerabilities in ISE and ISE-PIC that could allow an authenticated, remote attacker to perform command injection attacks on an affected device and execute arbitrary commands as the root user.
organisation CVE-2026-20322
CVE-2026-20322 (CVSS score: 9.9), CVE-2026-20325 (CVSS score: 9.9), CVE-2026-20326 (CVSS score: 9.8), CVE-2026-20360, CVE-2026-20361, CVE-2026-76409 - Multiple vulnerabilities in Cisco Nexus Dashboard that could lead to command injection, authentication or authorization bypass, and information disclosure.
infrastructure 76409 Multiple vulnerabilities
CVE-2026-20322 (CVSS score: 9.9), CVE-2026-20325 (CVSS score: 9.9), CVE-2026-20326 (CVSS score: 9.8), CVE-2026-20360, CVE-2026-20361, CVE-2026-76409 - Multiple vulnerabilities in Cisco Nexus Dashboard that could lead to command injection, authentication or authorization bypass, and information disclosure.
organisation CVE-2026-20130
CVE-2026-20130 (CVSS score: 10.0), CVE-2026-20192 (CVSS score: 10.0), CVE-2026-20194 (CVSS score: 9.1), CVE-2026-20234 (CVSS score: 9.9), CVE-2026-20237 (CVSS score: 9.9), CVE-2026-20287 - Multiple vulnerabilities in ISE and ISE-PIC that could lead to command injection, authentication or authorization bypass, and information disclosure.
infrastructure 20287 CVE-2026 Multiple
CVE-2026-20130 (CVSS score: 10.0), CVE-2026-20192 (CVSS score: 10.0), CVE-2026-20194 (CVSS score: 9.1), CVE-2026-20234 (CVSS score: 9.9), CVE-2026-20237 (CVSS score: 9.9), CVE-2026-20287 - Multiple vulnerabilities in ISE and ISE-PIC that could lead to command injection, authentication or authorization bypass, and information disclosure.
infrastructure 3.1
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Cisco releases patches for versions 3.1 through 3.5 of ISE and ISE-PIC but noted that version 3.0 is no longer supported and advised customers to upgrade to a fixed version.
infrastructure 3.2
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
infrastructure 3.3
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
infrastructure 3.4
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
infrastructure 3.51
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
infrastructure 3.5
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Cisco releases patches for versions 3.1 through 3.5 of ISE and ISE-PIC but noted that version 3.0 is no longer supported and advised customers to upgrade to a fixed version.
organisation Cisco
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
infrastructure 3.0
Cisco releases patches for versions 3.1 through 3.5 of ISE and ISE-PIC but noted that version 3.0 is no longer supported and advised customers to upgrade to a fixed version.
organisation CVE-2026-20306
CVE-2026-20305 (CVSS score: 9.1), CVE-2026-20306 (CVSS score: 9.1) - Multiple vulnerabilities in ISE and ISE-PIC that could allow an authenticated, remote attacker to perform command injection attacks on an affected device and execute arbitrary commands as the root user.
organisation ISE-PIC
CVE-2026-20305 (CVSS score: 9.1), CVE-2026-20306 (CVSS score: 9.1) - Multiple vulnerabilities in ISE and ISE-PIC that could allow an authenticated, remote attacker to perform command injection attacks on an affected device and execute arbitrary commands as the root user.
organisation CVE-2026-76423
CVE-2026-76423 (CVSS score: 10.0), CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, CVE-2026-76428 - Multiple vulnerabilities in ISE and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks on an affected de…
organisation CVE-2026-76425
CVE-2026-76423 (CVSS score: 10.0), CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, CVE-2026-76428 - Multiple vulnerabilities in ISE and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks on an affected de…
organisation CVE-2026
CVE-2026-76423 (CVSS score: 10.0), CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, CVE-2026-76428 - Multiple vulnerabilities in ISE and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks on an affected de…
organisation ISE
CVE-2026-76423 (CVSS score: 10.0), CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, CVE-2026-76428 - Multiple vulnerabilities in ISE and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks on an affected de…
organisation SQL
…026-76423 (CVSS score: 10.0), CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, CVE-2026-76428 - Multiple vulnerabilities in ISE and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks on an affected device.
organisation XML External
…026-76423 (CVSS score: 10.0), CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427, CVE-2026-76428 - Multiple vulnerabilities in ISE and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks on an affected device.
organisation CVE-2026-20353
CVE-2026-20353 (CVSS score: 9.8), CVE-2026-76440 (CVSS score: 9.8), CVE-2026-76441 (CVSS score: 9.8), CVE-2026-76442 (CVSS score: 9.8), CVE-2026-76443 - Multiple vulnerabilities in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager that could lead to path traversal, authentication or authorization bypass, uncontrolled resource consumption, and command injection.
organisation CVE-2026-76440
CVE-2026-20353 (CVSS score: 9.8), CVE-2026-76440 (CVSS score: 9.8), CVE-2026-76441 (CVSS score: 9.8), CVE-2026-76442 (CVSS score: 9.8), CVE-2026-76443 - Multiple vulnerabilities in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager that could lead to path traversal, authentication or authorization bypass, uncontrolled resource consumption, and command injection.
organisation CVE-2026-76441
CVE-2026-20353 (CVSS score: 9.8), CVE-2026-76440 (CVSS score: 9.8), CVE-2026-76441 (CVSS score: 9.8), CVE-2026-76442 (CVSS score: 9.8), CVE-2026-76443 - Multiple vulnerabilities in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager that could lead to path traversal, authentication or authorization bypass, uncontrolled resource consumption, and command injection.
organisation Vulnerability / Web Security
 Ravie Lakshmanan  Sep 17, 2026 Vulnerability / Web Security Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation.
organisation Identity Services Engine
 Ravie Lakshmanan  Sep 17, 2026 Vulnerability / Web Security Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation.
organisation Secure Firewall
Of the 77 new CVEs issued Wednesday, 41 affect ISE and 28 affect the Secure Firewall portfolio.
‎September 19, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026.
vulnerability CVE-2026-76460
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution Known Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
tactic T1588.006 - Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution Federal Civilian Executive Branch
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
attribution FCEB
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.
Tactical Metrics
Metrics
infrastructure
‎9.9
Software Version
CVE-2026-20329 (CVSS score: 9.9), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC)…
CVE-2026-20324 (CVSS score: 9.9) - A vulnerability in the sftunnel inter-device communication protocol of FMC Software that could allow an authenticated, remote attacker to execute arbitrary commands as root.
Metrics
infrastructure
‎9.6
Software Version
CVE-2026-20329 (CVSS score: 9.9), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC)…
Metrics
infrastructure
‎9.0
Software Version
CVE-2026-20329 (CVSS score: 9.9), CVE-2026-20330 (CVSS score: 9.9), CVE-2026-20331 (CVSS score: 9.6), CVE-2026-20332 (CVSS score: 9.0), CVE-2026-20333, CVE-2026-20334, CVE-2026-20335, CVE-2026-20336 - Multiple vulnerabilities in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC)…
CVE-2026-76412, CVE-2026-76413, CVE-2026-76420 (CVSS score: 9.0) - Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software that could allow a remote attacker to gain root access and perform session forgery or session impersonation.
Metrics
infrastructure
9
Multiple Vulnerabilities
CVE-2026-76412, CVE-2026-76413, CVE-2026-76420 (CVSS score: 9.0) - Multiple vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software that could allow a remote attacker to gain root access and perform session forgery or session impersonation.
Metrics
infrastructure
‎3.1
Software Version
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Cisco releases patches for versions 3.1 through 3.5 of ISE and ISE-PIC but noted that version 3.0 is no longer supported and advised customers to upgrade to a fixed version.
Metrics
infrastructure
‎3.2
Software Version
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Metrics
infrastructure
‎3.3
Software Version
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Metrics
infrastructure
‎3.4
Software Version
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Metrics
infrastructure
‎3.51
Software Version
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Metrics
infrastructure
‎3.5
Software Version
It has been addressed in the following versions - 3.1 - Fixed in 3.1 Patch 12 3.2 - Fixed in 3.2 Patch 11 3.3 - Fixed in 3.3 Patch 12 3.4 - Fixed in 3.4 Patch 7 3.51 - Fixed in 3.5 Patch 4 Cisco said it's "aware of active exploitation of this vulnerability," urging customers to upgrade to a fixed software release to counter the threat.
Cisco releases patches for versions 3.1 through 3.5 of ISE and ISE-PIC but noted that version 3.0 is no longer supported and advised customers to upgrade to a fixed version.
Metrics
infrastructure
‎9.8
Software Version
Software for Cisco Secure Email Gateway ( CVE-2026-76461 , CVSS score: 9.8) has come under active exploitation in the wild.
CVE-2026-20242 (CVSS score: 9.8) - A vulnerability in the External Database Access feature of FMC Software that could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device.
Metrics
infrastructure
9
Multiple Vulnerabilities
A brief description of the flaws is below - CVE-2026-20176 (CVSS score: 9.9), CVE-2026-20211 (CVSS score: 9.1), CVE-2026-20307 (CVSS score: 9.1) - Multiple vulnerabilities in ISE that could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.
CVE-2026-20305 (CVSS score: 9.1), CVE-2026-20306 (CVSS score: 9.1) - Multiple vulnerabilities in ISE and ISE-PIC that could allow an authenticated, remote attacker to perform command injection attacks on an affected device and execute arbitrary commands as the root user.
Metrics
infrastructure
76,409
Multiple Vulnerabilities
CVE-2026-20322 (CVSS score: 9.9), CVE-2026-20325 (CVSS score: 9.9), CVE-2026-20326 (CVSS score: 9.8), CVE-2026-20360, CVE-2026-20361, CVE-2026-76409 - Multiple vulnerabilities in Cisco Nexus Dashboard that could lead to command injection, authentication or authorization bypass, and information disclosure.
Metrics
infrastructure
20,287
Cve-2026 Multiple
CVE-2026-20130 (CVSS score: 10.0), CVE-2026-20192 (CVSS score: 10.0), CVE-2026-20194 (CVSS score: 9.1), CVE-2026-20234 (CVSS score: 9.9), CVE-2026-20237 (CVSS score: 9.9), CVE-2026-20287 - Multiple vulnerabilities in ISE and ISE-PIC that could lead to command injection, authentication or authorization bypass, and information disclosure.
Metrics
infrastructure
‎9.1
Software Version
CVE-2026-20340, CVE-2026-20341 (CVSS score: 9.1), CVE-2026-20342, CVE-2026-20343, CVE-2026-20344 - Multiple vulnerabilities in FMC Software that could allow a remote attacker to gain root access, download sensitive files, perform a SQL injection attack, or cause a denial-of-service (DoS) condition.
Metrics
infrastructure
‎Windows
Affected Product
Related: Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit Mitigating CVE-2026-76460 Exploitation CVE-2026-76460 affects ISE and ISE-PIC, regardless of device configuration.
Metrics
infrastructure
‎3.0
Software Version
Cisco releases patches for versions 3.1 through 3.5 of ISE and ISE-PIC but noted that version 3.0 is no longer supported and advised customers to upgrade to a fixed version.
Intelligence Sources
Dark Reading 2026-09-18
Infosecurity-Magazine 2026-09-17
The Hacker News 2026-09-17