Cisco has released emergency security updates for a maximum-severity authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that is being actively exploited as a zero-day. The flaw tracked as CVE-2026-76460, stems from insufficient authentication controls on an API endpoint, allowing unauthenticated remote attackers to send crafted requests, bypass the web-based management interface, and gain unauthorized access regardless of device configuration. Successful exploitation can enable root-level command execution, potentially allowing attackers to conceal or delete indicators of compromise. Cisco urges customers to upgrade immediately to ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12. While no workaround is available, infrastructure ACLs can restrict traffic and prevent remote exploitation. Organizations should inspect access.log files across all nodes and external firewall and network logs for suspicious activity, with Cisco recommending that potentially compromised systems be re-imaged and restored from trusted backups. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to remediate the flaw within by no later than September 19, 2026, under BOD 26-04. CTIX analysts urge any affected organizations to prioritize patching immediately as no workarounds currently exist.