Let me get the obvious part out of the way. I work at Portnox Security, we compete with Cisco’s Identity Services Engine (their NAC), and you’d reasonably expect me to show up this week with a big bowl of popcorn and a “have you considered switching?” marketing campaign. I’m going to disappoint you on that front, though – partly because I think dunking on a peer’s zero-day is a bad look, and mostly because nearly everything that went wrong here is a problem the whole industry shares.

Here’s what happened: Cisco disclosed CVE-2026-76460, a CVSS 10.0 flaw in ISE and ISE-PIC. Cisco said the vulnerability is due to insufficient authentication control on an API endpoint, and a successful exploit could let an attacker gain unauthorized access by bypassing the web-based management interface. It affects ISE and ISE-PIC regardless of device configuration and was already being exploited. Cisco also warned that attackers may obtain root command execution and that, because of that level of access, evidence of exploitation may be removed or hidden. CISA added it to the KEV catalog the same day with a federal remediation deadline of September 19 and flagged forensic triage as required. There’s no workaround, only patching and restricting who can reach the box.

I’m not going to pretend that’s fine. ISE’s entire job is deciding who is allowed to do what, and this bug let an unauthenticated stranger skip that question on the management plane. It also isn’t the first time. Last year Cisco disclosed CVE-2025-20337 on June 25, but Amazon found exploitation was already underway in May, with custom malware showing a deep understanding of Tomcat internals and the specific architecture of ISE. Google’s threat intel team described the underlying issue bluntly in their 2025 review: a lack of input validation and incomplete authorization were common flaws in these products, basic systemic failures that are fixable with proper implementation standards. Customers who trusted ISE to be their front door deserved better, and Cisco knows it.

Now zoom out a little, because this is where the pile-on gets lazy. The same week Cisco was scrambling, Check Point was dealing with a stack overflow in its Security Management Server login process that allowed unauthenticated root code execution on the machine that controls every firewall and policy in the deployment. That was the latest in a run of critical management-plane fixes Check Point has shipped since July, one of which was exploited before a patch was available. Go back a year and you’ll find Ivanti, Palo Alto, Citrix, and yes, Cisco again. Google tracked 90 zero-days exploited in 2025, and nearly half targeted enterprise technologies like security appliances, VPNs, and networking devices.

The reason is not complicated. The stuff we build sits at the choke points, runs with high privileges, talks to everything, and usually can’t run the EDR agent that would catch someone poking around inside it. Amazon’s CISO called out exactly this last year, describing a trend of threat actors focusing on critical identity and network access control infrastructure, the systems enterprises rely on to enforce security policy and manage authentication. If you want the keys to the building, you go after whoever is holding the keys, and access control vendors hold a lot of them.

There’s a second part of this story that’s getting buried under the CVSS 10 headline, and honestly it’s the part I find most encouraging. Of the 77 CVEs Cisco shipped that week, a big chunk came out of Cisco’s own hardening review, and Cisco says those were found during internal security testing using existing processes as well as frontier AI models. They also grouped the findings by CWE class and assigned one CVE per grouping to make patching easier for customers. Check Point’s exploited July bug came out of its own internal review process too, not a bug bounty or incident report. You can grumble about the patch volume (I did, a little), but vendors pointing serious tooling at their own code and shipping the results is the exact behavior we should want from all of us.

It’s also a warning, because this is happening everywhere. Zero Day Initiative reported its incoming bug submission rate tripled in early 2026, which it attributed to AI tooling broadly. The bugs were always sitting in the code; what changed is how fast they’re being found and exploited, and attackers have access to the same class of tools we do. So the race is now between how fast a bug gets found and how fast a fix gets onto every customer box, and that second number is where most of the industry is losing.

So what does leveling this up actually look like? For those of us who build this stuff, the management plane has to be treated as the crown jewel. That means pre-auth code paths get the paranoid review, admin interfaces aren’t reachable from places they shouldn’t be by default, and logging is designed on the assumption that the box itself might get owned. The joint guidance CISA and its international partners published last year spells out seven strategies: know the edge, procure secure-by-design devices, apply hardening and patches, implement strong authentication, disable unneeded features and ports, secure management interfaces, and centralize monitoring for threat detection. None of that is new, and all of it is still hard. We should all be sharing IOCs as fast as Cisco did here, and we should be making patching less painful, because a patch nobody can deploy in three days doesn’t protect anyone.

In fairness to my own side of the house: we run Portnox as a cloud service, so keeping the platform patched is our responsibility rather than yours. That doesn’t exempt us from anything I’ve said above. Everyone building access control is under the same pressure, and we hold ourselves to the same standard I’m asking of the rest of the industry. We run internal reviews and penetration tests continually, with some AI-assisted tooling in the mix, and we run a bug bounty program through Bugcrowd because good researchers deserve a clear, rewarded path to report what they find.

If you’re running ISE right now, skip everything above and do this. Patch to a fixed release and remember the September batch covers a lot more than this one CVE. Check the logs on every node, not just the primary. Cisco’s advisory includes a one-line command that searches each node’s access log for the suspicious username attackers have been using, and any hit should be treated as a likely compromise. If you find activity, Cisco advises re-imaging the affected nodes and restoring from configuration backup. Until you’re patched, lock management traffic down with infrastructure ACLs, and cross-check firewall and network logs for suspicious uploads and downloads, since attackers may wipe evidence on the box itself. If you need a second set of eyes and don’t want a sales pitch attached, reach out. I mean that.

The people exploiting this don’t care whose logo is on the appliance. The defenders at Cisco who gave up a weekend for this are on the same side as the rest of us, and so are the admins patching ISE clusters this week instead of sleeping. Nobody in this industry gets to feel smug about a week like this. What matters is whether we get better at this faster than the attackers do.