Cisco ISE Zero-Day Under Active Exploitation: Detection and Remediation Guide for Defenders

Cisco has released security updates for a maximum-severity vulnerability in Identity Services Engine (ISE) that threat actors are actively exploiting in the wild. This is not a theoretical risk scenario — Cisco's own advisory language confirms weaponized exploitation against unpatched deployments, which means any organization running a vulnerable ISE release should treat this as an incident-response scenario, not a routine patching ticket.

ISE is the policy brain of network access control in thousands of enterprise environments. It makes authentication and authorization decisions for every device and user touching the wired, wireless, and VPN edge. An attacker who owns your ISE Policy Administration Node (PAN) owns the trust fabric of your network: they can weaken 802.1X policy, whitelist rogue devices, harvest RADIUS/TACACS+ secrets, create local admin accounts, and pivot laterally with a trusted foothold that most EDR stacks never see. ISE appliances run on a hardened Linux base (ADE-OS) that typically has no endpoint agent coverage — visibility comes almost entirely from syslog forwarding and network telemetry.

If your ISE nodes are reachable from any untrusted segment — guest networks, partner links, or heaven forbid the internet — your exposure window is right now.

Technical Analysis

Affected Products

Cisco Identity Services Engine (ISE) — physical appliances (SNS-3xxx series), virtual appliances, and cloud-hosted ISE deployments
Cisco ISE Passive Identity Connector (ISE-PIC) where applicable per Cisco's advisory
Both standalone and distributed (PAN/MnT/PSN) deployment models are affected

Cisco's advisory enumerates the specific vulnerable and fixed release trains. Consult the advisory directly for your train: Cisco Security Advisories and the original reporting at BleepingComputer.

Severity

The vulnerability carries a CVSS score at or near the maximum (9.8–10.0 class), reflecting the worst-case combination defenders dread:

Network exploitable — reachable over the ISE management/API interface
No authentication required — the attacker does not need valid credentials
No user interaction required
High-privilege code execution — successful exploitation yields execution in the context of the ISE application, which runs with root-equivalent access on the underlying appliance

How the Attack Works (Defender's View)

Based on the vulnerability class and Cisco's advisory posture, the attack chain follows this shape:

Reconnaissance — attacker identifies exposed ISE nodes by fingerprinting the ISE web/admin services (TCP 443, and the ISE-specific service ports such as 8443 for guest/mydevices portals and 9060 for ERS API). Shodan and similar engines index ISE instances aggressively; assume your nodes have already been fingerprinted if they are internet-reachable.
Initial access — a crafted request to a vulnerable ISE service component triggers the flaw without any prior authentication. No stolen credentials, no phishing, no MFA fatigue required.
Execution — attacker-controlled code runs on the appliance. Because ISE services execute with elevated privileges, this is effectively root on the policy node.
Post-exploitation — typical follow-on behaviors we hunt for in these engagements: creation of rogue local admin accounts via the ISE CLI or API, deployment of persistence (cron entries, modified startup scripts, dropped binaries under writable paths), tampering with policy sets, and extraction of the ISE internal database (which contains device credentials, RADIUS shared secrets, and AD join account material if stored).
Lateral movement — from ISE, the attacker holds a trusted identity position: they can manipulate TACACS+ device administration, authenticate rogue assets onto protected VLANs, and harvest east-west creds.

Exploitation Status

Confirmed active in-the-wild exploitation per Cisco's warning
Treat as KEV-grade urgency — if not yet listed on the CISA Known Exploited Vulnerabilities catalog at time of reading, monitor it daily; actively exploited Cisco infrastructure CVEs have a consistent track record of KEV inclusion with aggressive federal remediation deadlines
Assume exploitation predates patch availability — retro-hunt, don't just patch and move on

Detection & Response

Because ISE is an appliance without EDR, your detection strategy rests on three legs: ISE syslog forwarding (which you must already have pointed at your SIEM — if not, fix that today), network telemetry around the ISE nodes, and post-patch forensic review of the appliance itself.

Sigma Rules

The following rules target the highest-fidelity observable behaviors: ISE service processes spawning shells or interpreters (near-zero legitimate baseline), unexpected outbound connections from ISE nodes, and rogue admin account creation in ISE audit logs.

YAML

---
title: Cisco ISE Service Process Spawning Shell or Interpreter
id: 3f8a1c92-6d4e-4b7a-9c51-2e8f0a1b3d44
status: experimental
description: Detects shells, interpreters, or download tools spawned as child processes of Cisco ISE application services. Post-exploitation of an unauthenticated RCE against ISE will frequently manifest as the ISE/java process tree executing bash, sh, python, curl, or wget. Legitimate baseline for this behavior is extremely low.
references:
  - https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1190
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/opt/CSCOcpm/'
      - '/opt/cisco/'
      - 'java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Cisco TAC-guided troubleshooting with root shell access
  - ISE backup/restore scripts during maintenance windows
level: critical
---
title: Cisco ISE Rogue Local Administrator Account Creation
id: 8b2e4f17-a3c9-4d61-8f22-9c0e5b7a1f66
status: experimental
description: Detects creation of new local administrator accounts on Cisco ISE via audit syslog. Attackers with code execution on a compromised PAN commonly establish persistence by minting local ISE super-admin accounts, which survive reboots and blend into normal admin inventory.
references:
  - https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: application
  product: cisco
  service: ise
detection:
  selection:
    Message|contains:
      - 'Administrator Added'
      - 'Added new Admin User'
      - 'Admin user created'
      - 'CREATE_ADMIN_USER'
  condition: selection
falsepositives:
  - Legitimate onboarding of new ISE administrators — validate against change tickets
level: high
---
title: Cisco ISE Node Outbound Connection to Non-Management Destination
id: 1c5d9e34-7f2b-4a88-b6c3-4d1e8a0f2c77
status: experimental
description: Detects ISE nodes initiating outbound network connections to destinations outside expected infrastructure (AD/LDAP, DNS, NTP, update servers, SIEM syslog target). Compromised ISE nodes beacon to C2 infrastructure; ISE has a tightly constrained, allowlistable egress profile making this high-signal.
references:
  - https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: firewall
  product: cisco
detection:
  selection_source:
    SourceIP|cidr:
      - '10.0.0.0/8'  # Replace with your actual ISE node subnet(s)
  selection_role:
    DeviceProduct: 'ISE'
  filter_expected:
    DestinationPort:
      - 53
      - 88
      - 123
      - 389
      - 636
      - 514
      - 443
  condition: selection_source and not filter_expected
falsepositives:
  - New integrations (pxGrid subscribers, MDM connectors) not yet baselined
  - Cisco Smart Licensing / update infrastructure — allowlist after verification
level: high

KQL (Microsoft Sentinel)

ISE nodes should be forwarding all audit, system, and diagnostic logs to your SIEM via syslog. This hunt query looks across ISE syslog ingestion for exploitation artifacts: unauthenticated errors against admin/API interfaces, admin account manipulation, and anomalous process execution logged by the appliance.

KQL — Microsoft Sentinel / Defender

// Hunt for Cisco ISE compromise indicators in syslog stream
// Assumes ISE nodes forward syslog to Sentinel via Syslog or CommonSecurityLog connector
let iseHosts = dynamic(["ise-pan-01","ise-psn-01","ise-psn-02"]); // replace with your ISE hostnames
union isfuzzy=true
(Syslog
| where Computer in~ (iseHosts)
| where SyslogMessage has_any (
    "Administrator Added", "Admin user created", "CREATE_ADMIN_USER",
    "authentication failed", "Invalid user", "Failed password",
    "cmd=", "bash", "/bin/sh", "wget", "curl ", "chmod +x")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
),
(CommonSecurityLog
| where DeviceProduct has "ISE" or SourceHostName in~ (iseHosts)
| where Message has_any ("Administrator Added","Admin user created","Failed password")
| project TimeGenerated, SourceHostName, DeviceEventClassID, Message
)
| order by TimeGenerated desc
| take 500

KQL — Microsoft Sentinel / Defender

// Network-layer hunt: ISE nodes talking to unusual external destinations
// Requires firewall/NSG flow data ingested to Sentinel
let iseSubnets = dynamic(["10.50.10.0/24"]); // replace with your ISE management subnet
let knownGoodPrefixes = dynamic(["ldap","kerberos","ntp","dns","syslog"]);
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where ipv4_is_in_range(RemoteIP, "0.0.0.0/0")
    and not(ipv4_is_private(RemoteIP))
| where DeviceName has_any ("ise","cisco")
| summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by DeviceName, RemoteIP, RemotePort, InitiatingProcessName
| order by ConnectionCount asc   // rare connections surface first

Velociraptor VQL

If you have root shell access to the ISE appliance during forensic review (post-patch, or via Cisco TAC session), Velociraptor deployed against the underlying Linux host — or against your broader Linux estate to catch pivots — can hunt for dropped binaries and persistence. Deploy only with Cisco TAC awareness on the appliance itself.

VQL — Velociraptor

-- Hunt for recently dropped executables and persistence artifacts on Linux hosts
-- Run against ISE underlying OS (via TAC session) and adjacent Linux infrastructure
SELECT
    FullPath,
    Size,
    Mtime,
    Ctime,
    Mode
FROM glob(
    globs=[
        '/tmp/*',
        '/var/tmp/*',
        '/dev/shm/*',
        '/opt/**/bin/*'
    ],
    accessor='file'
)
WHERE Mtime > timestamp(epoch=now() - 60*60*24*14)   -- modified in last 14 days
  AND Mode =~ 'x'                                     -- executable bit set
  AND NOT FullPath =~ '/opt/CSCOcpm/bin'              -- exclude known ISE binaries
ORDER BY Mtime DESC

VQL — Velociraptor

-- Enumerate cron and systemd persistence planted post-compromise
SELECT
    FullPath,
    Mtime,
    read_file(filename=FullPath, length=4096) AS Content
FROM glob(
    globs=[
        '/etc/cron.d/*',
        '/etc/cron.daily/*',
        '/var/spool/cron/*',
        '/etc/systemd/system/*.service'
    ],
    accessor='file'
)
WHERE Mtime > timestamp(epoch=now() - 60*60*24*30)
ORDER BY Mtime DESC

Verification & Hardening Script

Run this from a jump host with SSH access to your ISE nodes to inventory exposure, pull version data for patch verification, and sweep for the most common post-exploitation artifacts. Requires an ISE admin CLI account.

Bash / Shell

#!/bin/bash
# Cisco ISE Zero-Day Triage Script - Security Arsenal
# Run against each ISE node (PAN, MnT, PSN). Requires SSH admin access.
# Usage: ./ise_triage.sh <ise-node-fqdn>

NODE="$1"
ADMIN_USER="admin"   # ISE CLI admin account

if [ -z "$NODE" ]; then
  echo "Usage: $0 <ise-node-fqdn>"; exit 1
fi

echo "=================================================="
echo "[+] ISE Triage: $NODE  ($(date -u))"
echo "=================================================="

# 1. Capture running version - verify against Cisco fixed-release list
echo "--- [1] Software Version ---"
ssh "${ADMIN_USER}@${NODE}" "show version" 2>/dev/null | tee "ise_version_${NODE}.txt"

# 2. Running services - confirm persona (standalone/PAN/PSN) for patch scoping
echo "--- [2] Application Status ---"
ssh "${ADMIN_USER}@${NODE}" "show application status ise" 2>/dev/null

# 3. Inventory local admin accounts - flag anything not in your change records
echo "--- [3] Local Admin Accounts (validate against change control) ---"
ssh "${ADMIN_USER}@${NODE}" "show user" 2>/dev/null

# 4. Established connections off the appliance - hunt for C2/session anomalies
echo "--- [4] Active Network Connections ---"
ssh "${ADMIN_USER}@${NODE}" "show tech" 2>/dev/null | grep -A 200 "netstat" | head -60

# 5. Check interface exposure: admin/guest portals should NOT be internet-facing
echo "--- [5] Reminder: verify ACLs restrict TCP 443/8443/9060 to mgmt subnets ---"

echo "=================================================="
echo "[!] NEXT STEPS:"
echo "    - Compare version output against Cisco advisory fixed releases"
echo "    - If vulnerable AND node was reachable from untrusted networks:"
echo "      open an IR bridge, preserve logs BEFORE patching"
echo "    - Rotate ISE admin credentials and RADIUS/TACACS shared secrets"
echo "      if any compromise indicators surface"
echo "=================================================="

Remediation

1. Patch Immediately — In the Correct Order

Download the fixed software for your ISE release train from Cisco Software Central and apply per the advisory instructions at Cisco Security Advisories.
In distributed deployments, patch the Primary Administration Node (PAN) first, then Monitoring (MnT) nodes, then Policy Service Nodes (PSNs) — with a full configuration backup and (for VMs) a snapshot taken before you begin.
Validate service restoration (show application status ise) and 802.1X/guest/portal functionality after each node. A botched ISE upgrade that drops PSNs mid-day is its own incident.
Monitor the CISA KEV catalog — if this vulnerability is added, federal agencies face a binding remediation deadline, and private-sector teams should treat that date as their own outer bound.

2. Restrict Exposure — Workaround Where Patching Must Wait

There is no substitute for the patch, but exposure reduction buys time:

Enforce ACLs so the ISE administration interface and API service ports (TCP 443, 8443, 9060) are reachable only from a dedicated management subnet / jump host. ISE admin interfaces should never be reachable from user VLANs, guest networks, or the internet.
If any ISE node was ever internet-exposed, assume compromise until forensically cleared.
Audit pxGrid/ERS API client registrations and disable unused integrations.

3. Retro-Hunt Before and After Patching

Patching a compromised box without investigating just gives the attacker a cleaner box. Before you patch:

Export and preserve ISE operational and audit logs (they roll over).
Review admin account inventory, API authentication logs, and configuration change history for the exposure window.
Check for unexpected scheduled jobs, local accounts, and certificate changes.

4. Credential Rotation if Compromise Is Suspected

All ISE local admin credentials
RADIUS shared secrets on NADs (switches, WLCs, VPN headends)
TACACS+ keys
AD machine/service accounts used for ISE domain join
Any certificates deployed from the ISE internal CA, if the internal CA keys may have been exposed

5. Longer-Term Hardening

Forward all ISE logging (audit, system, diagnostics) to your SIEM with alerting on admin changes — most organizations only forward authentication logs and are blind to exactly the events that matter here.
Segment ISE management traffic onto a dedicated VRF/VLAN with east-west inspection.
Include ISE in your vulnerability-management SLA tier for "network control plane" assets: 24–72 hour patch targets for actively exploited CVEs, not the standard 30-day cycle.

Bottom Line

A max-severity, unauthenticated, actively exploited flaw in the system that decides who gets on your network is a drop-everything event. Patch the PAN today, verify no ISE service interface is exposed beyond your management plane, and retro-hunt the exposure window before you close the ticket. The organizations that get hurt in these campaigns are rarely the ones who couldn't patch — they're the ones who patched without ever checking whether someone got there first.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub