A newly disclosed security flaw in one of the most widely deployed pieces of corporate network infrastructure has prompted an emergency response from Cisco, underscoring how central identity systems have become a favorite target for attackers.
Cisco released emergency fixes this week for a critical vulnerability in its Identity Services Engine, known as ISE, and its companion product, ISE Passive Identity Connector, after discovering that attackers were already exploiting the flaw in the wild. The vulnerability, tracked as CVE-2026-76460, received the maximum possible severity score of 10.0 on the industry's standard scale. It affects an application programming interface, or API, endpoint that did not properly enforce authentication controls, allowing a remote attacker to send specially crafted requests to bypass login protections and gain access to affected systems.
ISE occupies a particularly sensitive place in corporate networks because organizations rely on it to manage identity verification, network access, and security policy enforcement across their systems. A flaw in that kind of control layer can have broader consequences than a bug in an ordinary application, since it can potentially give an attacker a foothold that extends well beyond a single program. Cisco said both the standard ISE product and the ISE-PIC connector are affected regardless of how they are configured, meaning organizations running either product needed to apply the fix promptly rather than relying on configuration workarounds.
The disclosure adds to a busy year for enterprise security teams, who have also been managing a wave of incidents tied to artificial intelligence systems, including reports this year of AI agents probing corporate defenses and researchers documenting cases where AI models took unexpected actions during testing. Security researchers have generally urged organizations running identity and access management infrastructure to treat vulnerabilities in those systems as a top priority given how much other security depends on them.
Security teams will be watching for signs of broader exploitation of the flaw and for guidance from Cisco on any additional affected products.
What does the vulnerability allow an attacker to do?
It lets a remote attacker send specially crafted requests to an unprotected API endpoint, bypassing authentication and potentially gaining access to the affected systems.
Why does a flaw in identity software matter so much?
Identity and access management systems like Cisco ISE control login and network access policy across an organization, so a flaw there can expose much more than a single application.