Zero-day exposes Cisco ISE

Article by Nacata Security, 18/09/2026

Does your network decide who gets in and who doesn’t based on the rules you set?

Cisco has just confirmed that this lock has an actively exploited crack.

Identity Services Engine controls access to your network: who gets in, with what permissions, and from which device. It is not a peripheral component.

A flaw at that point can open the entire infrastructure to anyone who knows where to push, with nothing else required.

The zero-day carries the maximum possible score: CVSS 10.0.

The issue lies in insufficient authentication control on an API endpoint. A remote attacker can reach it without credentials, bypass authentication at the API gateway, and gain unauthorized access to the system, including the web administration interface. No account needed. No password needed. They only need to know the flaw exists — and they already do.

And from there, it escalates to root privileges.

With that level of control, the attacker can erase traces, conceal indicators of compromise, and manipulate the platform at will. What makes this case particularly uncomfortable is that the flaw does not depend on any specific configuration: Cisco confirms that ISE and ISE-PIC are affected regardless of how they are configured. There is no secure configuration that will save you if you do not patch.

No workarounds exist that eliminate the risk: only the patch.

Cisco has released fixes for branches 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. If you are still on branch 3.0, it no longer has active maintenance and you need to plan an urgent migration to a supported version that includes the fix.

Log review is urgent, not optional.

While you complete the update, Cisco recommends reviewing the ise-kong access.log and the access.log of each node, looking for suspicious usernames in requests to the API gateway. Cross-referencing those records with firewall and perimeter logs helps detect unexpected transfers to external IPs.

If you find indicators, the response level escalates.

Cisco goes beyond the patch: if solid signs of exploitation or compromise appear, the recommendation is to reinstall the affected nodes and restore the configuration from clean backups. In addition, it proposes applying iACLs to limit management and control-plane traffic — a measure that reduces the attack surface in environments where stopping services is not always immediate.

Reducing the attack surface while patches are deployed is key.

iACLs allow you to restrict what traffic reaches management points before the patch is installed on all nodes. In large environments, where updating every component takes time, that exposure window can be the interval an attacker needs to get in.

Confirmed active exploitation completely changes the response priority.

When Cisco states there is active exploitation in the wild, the clock is already running. This is not a preventive warning: it is confirmation that someone is using this flaw right now against real infrastructures. Every hour without patching is an hour of real exposure.

The question is not whether to patch, but when.

If your organization uses Cisco ISE or ISE-PIC, the first step is to identify which version you are on and whether the patch is available for that branch. If you are on a version without active support, the urgency is twofold: no future patch will arrive on its own and exposure grows every day.

Update, review logs, and do not wait any longer.

The combination of CVSS 10.0 and confirmed active exploitation makes this zero-day an absolute priority. Does your team already have the update plan underway?

Does your team already know which version of ISE is running right now?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime