Cisco shipped a fix this week for CVE-2026-76460, an authentication bypass in Identity Services Engine that scores a perfect 10 on CVSS. The flaw sits in ISE's API endpoint authentication, the layer that is supposed to confirm a caller is who it claims to be before handing back network access decisions. CISA added it to the Known Exploited Vulnerabilities catalog on September 16, 2026. A perfect 10 on an identity platform means the attacker does not need a stolen credential. They need the endpoint.

ISE is the box that tells a corporate network who gets on and who doesn't, running the authentication and authorization for every device that touches the network, wired or wireless. An unauthenticated bypass there does not compromise one account. It compromises the control that decides which accounts get to exist on the network at all. Cisco's own advisory frames this as a single fixed API issue. The EPSS score sitting at just 1% says the modeling has not caught up to what CISA's KEV placement already concluded: this is being exploited now, prediction models notwithstanding.

Cisco is the vendor on the hook, ISE is the product, and CVE-2026-76460 is the instrument banks running Cisco's identity stack now have to track against their own patch cycles. The same week, Cisco separately fixed CVE-2026-76461, a SQL injection in Secure Email Gateway rated 9.8, which is not the same flaw, not the same product, and not a coincidence anyone at Cisco has explained. Two maximum-tier bugs in one identity-and-access vendor's stack, disclosed inside the same seven days, is the fact that settles how this week reads for Cisco's enterprise base.