- Engineer — Act: Cisco ISE is a common enterprise NAC/identity platform; max severity plus confirmed active exploitation demands immediate patching — apply Cisco’s released security update to all ISE nodes now and verify no unauthorized admin sessions exist.
- SOC/IR — Act: Compromise of ISE could yield network access bypass or credential theft; hunt for anomalous authentication events, unexpected admin logins, and unusual policy changes in ISE audit logs since the vulnerability window opened.
- Leader — Act: Cisco ISE is widely deployed for network access control; confirm whether your organization runs it and direct teams to emergency-patch this week — active exploitation of identity infrastructure at max severity is a likely board or customer question.