🚨[Cisco ISE CVE-2026-76460] 311 attacking IPs and counting

Key findings

• 42 days between Cisco’s warning and the tracker’s first sighting: Cisco confirmed active exploitation on September 16, and the Live Exploit Tracker’s first-seen date for CVE-2026-76460 is October 28. Attacks began well before that date, so your log review has to reach further back.
• A sweep from rented cloud: 540 signals between October 28 and November 1, peaking at 209 from 116 unique IP addresses on October 30. 63% came from Ireland, and 198 of the 270 addresses in CTI are Amazon addresses there.

What is Cisco ISE, and who is exposed to CVE-2026-76460?

Cisco Identity Services Engine (ISE) decides which people and devices may join a company network. Network and security teams run it, and its management interface belongs on an internal management network. Every deployment on an unfixed release is affected; those reachable from the internet are the ones scanners can find.

Why CVE-2026-76460 matters: Cisco says exploitation can give root command execution with no login. ISE holds the rules for network access, so root there means seeing who is connected and changing who gets in.

What is the CrowdSec Network observing for CVE-2026-76460?

Between October 28 and November 1, 2026, the CrowdSec Network recorded 540 signals from machines reporting requests that match the CVE-2026-76460 exploitation pattern, detected by the CrowdSec rule live since October 28. That averages 108 per day, peaking at 209 from 116 unique IP addresses on October 30. The Live Exploit Tracker lists 311 unique IP addresses through November 2.

By day: 68 on Wednesday the 28th (a part day, since the rule went live that afternoon), 132, 209, then 60 and 71 over the weekend. The tracker moved CVE-2026-76460 from Limited to Active Exploitation on October 29.

The 42 days before that first sighting have a specific explanation: a rule needs a request to match, and the working request was not public.

• September 16: Cisco publishes its advisory, naming no endpoint, and CISA adds the CVE to KEV.
• September 18: Rescana notes that the “exact API endpoint and request shape are not published”.
• September 21 and 29: The path surfaces in a honeypot project and a detection module in the Kittysploit framework. Neither sends the made-up cookie.
• October 23: The Nuclei template is merged; the first public check we found that does. EPSS, flat at 14.0% since at least October 2, reaches 75.6% by October 25. Exploit code feeds that model, so it confirms the timing rather than any attack.
• October 24: CrowdSec generates its rule from the template, the tracker’s “Rule Released” date.
• October 28: The rule goes live after review, and the tracker records its first sighting.

Sources concentrate in rented cloud: 63% of signals came from Ireland, 16% from the Netherlands, 8% from the US, and 5% from Russia. CTI links 270 addresses to CVE-2026-76460 over the 30 days to November 2, and 198 of them are Amazon in Ireland, consistent with rented infrastructure rather than a residential botnet. Yandex Cloud in Russia adds 17, and research scanners from Hadrian, watchTowr, and CERT Polska appear too. Targets follow where CrowdSec is deployed: 40% of signals hit machines in France, 16% in Germany, 12% in Australia.

The part worth flagging is the weekend drop. Signals from Ireland fell from 165 on Friday, October 30, to 20 on Saturday. The tracker currently describes a cooling-off. It may just be the weekend, and this week’s numbers will settle it.

How do you protect Cisco ISE against CVE-2026-76460?

• Patch. Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4, or migrate off 3.0 (Cisco advisory).

• Preemptive blocking. Subscribe to the CrowdSec Intelligence Blocklists and enforce them on the firewall in front of ISE. 59 of the 270 addresses CTI links to CVE-2026-76460 (22%) are on at least one CrowdSec blocklist. That trims the sweep. It does not cover rotating cloud addresses or an attacker the network has never seen.

• Stay proactive. Follow CVE-2026-76460 on the Live Exploit Tracker and query its sources in CrowdSec CTI.

Unsure where to start? Begin with our 3-minute introduction track.

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

For more information, visit www.crowdsec.net