Two Cisco Zero-Days in 48 Hours: CVE-2026-76460 (ISE Auth Bypass) and CVE-2026-76461 (Secure Email Gateway Root RCE) Explained

Quick answer: CVE-2026-76460 is a CVSS 10.0 authentication bypass in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC): an unauthenticated attacker sends one crafted request and gets past the web management interface, and Cisco warns that successful exploitation can lead to command execution as root. CVE-2026-76461 is a CVSS 9.8 SQL injection in the email-parsing logic of Cisco AsyncOS for Secure Email Gateway: an attacker sends a crafted email through the appliance and ends up running commands as root on it. Both are exploited in the wild, both are in the CISA Known Exploited Vulnerabilities catalog, neither has a workaround, and the only fix for each is the patched build listed below.

Two doors, one week

Think of a corporate network as a building. Cisco ISE is the bouncer at every door: when a laptop, a phone, or a badge reader tries to join the network, ISE decides whether it is allowed in and what it may reach once inside. Cisco Secure Email Gateway is the mailroom: every inbound message is opened, inspected for malware and phishing, and only then passed to a human. Both sit in the path of everything. Both, it turns out, had a flaw that let a stranger in without a key, and in both cases Cisco learned about it because someone was already using it.

That is what makes this week unusual, not just the severity. Cisco published the email-gateway advisory on September 14 and CISA added the CVE to its exploited-vulnerabilities catalog the same day, which means it was a zero-day before anyone outside the attackers knew it existed. Two days later, on September 16, Cisco published the ISE advisory with the same two words attached: active exploitation. Both flaws were found while Cisco engineers were resolving customer support cases, which is the polite way of saying a customer had already been hit. If you read our breakdown of the Secure Firewall SSL VPN flaw in August, the pattern will feel familiar: an internet-facing Cisco appliance, no credentials required, patch-only remediation.

CVE-2026-76460: the bouncer waves you through

ISE is Cisco’s network access control and identity platform. It authenticates devices and users against your directory, enforces policy (this laptop gets the finance VLAN, that phone gets guest Wi-Fi), and pushes those decisions to every switch, wireless controller, and firewall that trusts it. It is administered through a web interface and a set of APIs. CVE-2026-76460 lives in one of those API endpoints: the endpoint does not check authentication strictly enough, so a request crafted the right way is treated as if it came from a logged-in administrator. Cisco’s own advisory says the flaw applies regardless of device configuration, so there is no setting that makes you safe, and it adds that threat actors may obtain command execution with root privileges after exploitation.

Read that as an attacker would. Root on ISE means the ability to rewrite who is allowed onto the network, to read whatever credentials and certificates the appliance holds for its integrations, and to delete the logs that would show any of it happened. Cisco says exactly that: because of the level of access, evidence of exploitation may be removed or hidden, so you must cross-check logs on firewalls and network devices outside the compromised box.

Was anyone already in? Cisco’s indicator is a suspicious username appearing in the API gateway access log. Its example uses “dummyuser”, but treat any account name you do not recognise the same way, and check every node in a distributed deployment, not just the primary admin node.

! From the ISE admin CLI, look for unexpected usernames in the API gateway log
admin# show logging application ise-kong/access.log | include dummyuser

! Older, rotated access logs: collect a support bundle with "include debug logs",
! use shared-key encryption, decrypt it, then inspect
!   ./ise/logs/apigateway/access.log.*.gz

! Any hit on any node is a potential compromise. Cisco's guidance: re-image the
! affected nodes and restore from a configuration backup. Then cross-check firewall
! and network logs for unexpected uploads from ISE to external IPs, or downloads
! from malicious IPs; the attacker may have cleaned the appliance's own logs.

CVE-2026-76461: the mailroom opens a letter and it takes over the building

Secure Email Gateway (the appliance many teams still call ESA, or IronPort) runs AsyncOS and sits in front of your mail server. Its whole job is to accept email from strangers on the internet, so it cannot demand authentication before it looks at a message. CVE-2026-76461 is a SQL injection in the code that parses those messages: a crafted email carries SQL statements, the parser fails to validate them, the statements run against the appliance’s database, and from there the attacker executes commands as root on the underlying operating system. No login, no click by a user, no attachment that needs opening. Delivery is the exploit.

Cisco confirmed the flaw affects both physical and virtual appliances regardless of configuration, and that Secure Email and Web Manager and Secure Web Appliance are not affected. On Cisco Secure Email Cloud, customers without CLI access cannot check the indicators themselves; Cisco says it has contacted the cloud customers where malicious activity was detected. Cisco’s PSIRT became aware of exploitation in September 2026, and CISA listed the CVE on September 14, the day of disclosure.

The upgrade is done from the appliance’s web interface: System Administration, then System Upgrade, then Upgrade Options, then Download and Install, choosing the fixed release for your train. Before you upgrade, check whether you were already exploited, because the fix does not evict an attacker who is already root.

# Cisco's indicator: SQL that writes to a program, in the text mail logs
cisco-esa> grep -i "COPY.*TO PROGRAM" mail_logs

# In a cluster, run this on every member: exploitation on one node can expose the
# private SSH keys members use to trust each other, so one hit means rotate them all.

# If you find a hit on a VIRTUAL appliance, Cisco's recovery sequence is:
#   1. preserve forensics first (a new instance destroys logs and config)
#   2. deploy a NEW virtual machine on a fixed release
#   3. rebuild the configuration from scratch
#   4. renew all credentials and cryptographic material on the appliance
#   5. keep monitoring for anomalous behaviour
# On a PHYSICAL appliance, engage Cisco TAC and enable remote access for them.

Why the pairing matters more than either flaw alone

Individually these are two bad Cisco bugs in a year that has had several. Together they hit the two places an attacker most wants to be. The email gateway is the easiest way in: it must accept mail from anyone, so it is reachable from anywhere, and the exploit needs nothing but a delivered message. ISE is the most valuable place to end up: it is the source of truth for who belongs on the network. An intruder who lands on the gateway and then reaches ISE is not stealing one mailbox; they are minting their own network access and erasing the record of having done so. That is why Cisco’s advice on both advisories is the same and unusually blunt: assume the appliance’s own logs may have been cleaned, and look for the intrusion from the outside.

• September 14: Cisco publishes the Secure Email Gateway advisory (CVE-2026-76461). CISA adds it to the KEV catalog the same day.
• September 16: Cisco publishes the ISE advisory (CVE-2026-76460), confirms active exploitation, and CISA adds it to KEV. Cisco ships an ISE hardening release alongside it.
• September 17: the email-gateway advisory is revised (version 1.1) with expanded exploitation and recovery guidance.
• Now: both remain patch-only. The fixed builds above are the remediation; ACLs on the ISE management plane are a stopgap, not a fix.

The part auditors test: this is a controls story

Strip out the product names and this week is a checklist of controls every serious framework already requires. A management plane reachable from where it should not be, a critical patch that has to land in days not quarters, logs that live only on the device that got compromised, and privileged credentials that were never rotated after an incident: these are the things a SOC 2 or ISO 27001 auditor tests. Here is how the two CVEs map to the controls that contain them.

What to do today

• ISE and ISE-PIC: upgrade every node to the first fixed patch for your train (3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4). If you are on 3.0, plan the migration now; there is no fix for it.
• Secure Email Gateway: upgrade to 15.5.5-014, 16.0.4-302, or 16.5.0-780. Cisco’s recommendation is to go to 16.5.0-780 if you can.
• Before and after patching, run the two log hunts above on every node and every cluster member. A patch does not remove an attacker who already has root.
• Put an infrastructure ACL in front of ISE’s management and API interfaces so only management networks can reach them, and keep it after patching.
• Confirm both appliances forward logs off-box, and cross-check firewall and proxy logs for unexpected traffic from either appliance to external addresses.
• If you find any indicator: preserve forensics, re-image or redeploy on a fixed release, rebuild configuration, and rotate every credential, certificate, and SSH key the appliance held.

The uncomfortable question: which of your appliances answers to the internet?

Most organisations find out which Cisco appliances they run, and which ones are reachable from outside, only when an advisory forces the question. That is backwards. Continuous attack-surface monitoring discovers every internet-facing appliance and the software train it runs, flags an unpatched build as a finding the day the advisory lands, and maps it to the SOC 2 and ISO 27001 controls it breaks. Continuous control monitoring then keeps that evidence current, so “we patched it within 48 hours” is a dated, tested record rather than a sentence in an email. For the durable version of this playbook, the hardening and patch loop that stops the next Cisco advisory from being a surprise, see our guide to securing Cisco Secure Firewall; every principle in it applies to ISE and the email gateway too.

Frequently asked questions

What is CVE-2026-76460?

A CVSS 10.0 authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector. An unauthenticated remote attacker can send a crafted request and bypass the web management interface; Cisco warns exploitation may lead to command execution with root privileges. It affects ISE regardless of configuration.

What is CVE-2026-76461?

A CVSS 9.8 SQL injection in the email-parsing logic of Cisco AsyncOS for Secure Email Gateway. An attacker sends a crafted email through the appliance and can execute arbitrary commands as root on it. No authentication or user interaction is required, and physical and virtual appliances are affected regardless of configuration.

Are these Cisco vulnerabilities being exploited?

Yes. Cisco’s PSIRT confirmed active exploitation of both. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalog on September 14, 2026, the day it was disclosed, and CVE-2026-76460 on September 16, 2026. Both were found while Cisco resolved customer support cases, meaning customers had already been compromised.

Which versions are fixed?

ISE and ISE-PIC: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4; release 3.0 is end of maintenance and must be migrated. Secure Email Gateway (AsyncOS): 15.5.5-014 for 15.5 and earlier, 16.0.4-302 for 16.0, and 16.5.0-780 for 16.5, which Cisco recommends as the target for everyone below 16.5.

Is there a workaround?

No, for either CVE. For ISE, Cisco offers a mitigation only: infrastructure access control lists that restrict management and control-plane traffic to the appliance. For the email gateway there is no mitigation at all, because accepting email from the internet is the appliance’s function. Upgrading is the fix.

How do I know if we were already compromised?

ISE: search the API gateway access log on every node for unfamiliar usernames (Cisco’s example command is show logging application ise-kong/access.log | include dummyuser). Email gateway: search mail_logs on every cluster member for SQL of the form COPY ... TO PROGRAM. Because attackers may clean the appliance’s own logs, Cisco also advises checking firewall and network logs outside the device for unexpected uploads or downloads. Any hit means re-image or redeploy on a fixed release, rebuild configuration, and rotate credentials and keys.