Cisco ISE max-severity zero-day actively exploited in attacks

Thu, 17 Sep 2026 15:32:45 +0000

Engineer — Act: Cisco ISE is a common enterprise NAC/identity platform; max severity plus confirmed active exploitation demands immediate patching — apply Cisco’s released security update to all ISE nodes now and verify no unauthorized admin sessions exist.
SOC/IR — Act: Compromise of ISE could yield network access bypass or credential theft; hunt for anomalous authentication events, unexpected admin logins, and unusual policy changes in ISE audit logs since the vulnerability window opened.
Leader — Act: Cisco ISE is widely deployed for network access control; confirm whether your organization runs it and direct teams to emergency-patch this week — active exploitation of identity infrastructure at max severity is a likely board or customer question.

Cisco-Ise on CuraSec