Cisco Warns of Two Exploited Zero-Days: ISE Auth Bypass and Email Gateway RCE

Cisco has disclosed two separate zero-day vulnerabilities that are already being exploited in active attacks. The first, CVE-2026-76460, affects the Identity Services Engine (ISE) and carries a perfect CVSS score of 10.0. As reported by Dark Reading, The Register, and The Hacker News, this authentication bypass allows an unauthenticated remote attacker to bypass security controls. The three sources agree on the severity and the active exploitation, noting it follows another Cisco zero-day just days earlier.

The second flaw, CVE-2026-76461, targets AsyncOS Software for Cisco Secure Email Gateway and has a CVSS score of 9.8. The Hacker News reports that this vulnerability enables root command execution, also under active exploitation. While both are critical Cisco zero-days, they affect different products and are tracked separately; the sources do not indicate any shared root cause.

Cisco has issued advisories for both vulnerabilities, and administrators are urged to apply patches immediately. The rapid succession of exploited flaws highlights the ongoing challenge of securing network infrastructure against sophisticated attackers. As the sources note, the ISE flaw in particular is a maximum-severity issue that demands urgent attention.