Cisco ISE CVE-2026-76460 (CVSS 10) and Email Gateway CVE-2026-76461: Exploited Zero-Days

Cisco disclosed two actively exploited zero-days within days of each other. Both affect appliances that sit at a trust boundary: the one that decides who is allowed onto the network, and the one that handles inbound email. A Help Net Security weekly round-up flagged both. This post covers what is confirmed, what is not, and what we would do first.

What was disclosed

CVE-2026-76460: Identity Services Engine

The flaw is described as insufficient authentication control on an API endpoint. Crafted requests let an unauthenticated attacker bypass the ISE web-based management interface, and Cisco rates it CVSS 10. Help Net Security reports that it affects ISE and the ISE Passive Identity Connector (ISE-PIC) on releases 3.0 through 3.5. It lists these fixes:

• 3.1 Patch 12
• 3.2 Patch 11
• 3.3 Patch 12
• 3.4 Patch 7
• 3.5 Patch 4

CyberScoop reports that the flaw was found during a technical support case and that it was added to CISA's Known Exploited Vulnerabilities catalogue shortly after disclosure. It also notes this is the third actively exploited ISE vulnerability since June 2025, after CVE-2025-20337 and CVE-2025-20281.

CVE-2026-76461: Secure Email Gateway

This is a SQL injection in the email-parsing logic of Cisco AsyncOS. According to eSecurity Planet, a crafted email is enough to reach arbitrary SQL execution and then command execution as root. The attacker needs no login and no access to the administrative interface. The flaw is rated CVSS 9.8 and was disclosed on 14 September 2026. It affects physical and virtual appliances regardless of configuration. Cisco's Product Security Incident Response Team became aware of exploitation in September.

Not one campaign, and no workaround

The consecutive CVE numbers invite the assumption of a shared root cause. Cisco's position, as quoted by CyberScoop, is that the two flaws affect different codebases and that CVE numbers are assigned first-come, first-served. Treat them as two separate patch tasks, not one incident.

Cisco says neither flaw has a workaround. You cannot fall back on restricting a feature or disabling a service, so the patch is the only fix, and any delay leaves the exposure open.

Why this matters

This is our analysis, not a claim from the sources. Identity and mail appliances are attractive because of what they hold and where they sit. A compromised policy engine or mail gateway gives an attacker a trusted position inside the network. These devices also tend to be excluded from the endpoint tooling that would otherwise notice an intruder.

Both flaws were exploited before a fix was available. A device that is patched now may already have been compromised earlier. The order of work is therefore to patch, then check the device, then decide whether it can be trusted.

What to do now

1. 1Inventory every ISE, ISE-PIC and Secure Email Gateway instance, including virtual and lab deployments, and confirm the running release.
2. 2Apply the fixed release for your train. The ISE patch levels are listed above, and the email gateway fixes are in Cisco's advisory.
3. 3On ISE, review access.log for suspicious usernames. On the email gateway, search mail_logs for COPY.*TO PROGRAM. On both, check network and firewall logs for unexpected uploads to external IPs or downloads from unfamiliar systems.
4. 4If you find signs of compromise on ISE, the reporting advises re-imaging the affected nodes and restoring from a configuration backup, not just patching in place.
5. 5Restrict management-plane exposure where you can, even though it is not a substitute for patching.

Since the ISE flaw is the third exploited ISE bug in about 15 months, consider making the exposure of the ISE management interface a standing review item.