CVE-2026-76460: 
Cisco ISE vulnerability analysis and mitigation

CVE-2026-76460 is a critical authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that allows an unauthenticated, remote attacker to bypass authentication and gain unauthorized access to the web-based management interface. The vulnerability was disclosed on September 16, 2026, and was discovered during the resolution of a Cisco Technical Assistance Center (TAC) support case. Affected versions span ISE releases 3.1 (p8–p11), 3.2 (p7–p10), 3.3 (Patch 1–11), 3.4 (base through Patch 6), and 3.5 (base through Patch 3), as well as ISE-PIC 3.4.0 and 3.5.0. It carries a CVSS v3.1 base score of 10.0 (Critical) (Cisco Advisory, GitHub Advisory).

The root cause is classified as CWE-648 (Incorrect Use of Privileged APIs): the affected API endpoint does not enforce proper authentication controls, allowing requests to be processed without valid credentials. An attacker exploits this by sending a specially crafted HTTP request directly to the vulnerable API endpoint, bypassing the web-based management interface's authentication layer entirely. No privileges, user interaction, or special network positioning are required — the attack is fully remote and network-accessible. Upon successful exploitation, threat actors may obtain command execution with root privileges on the affected device (Cisco Advisory).

Successful exploitation grants an unauthenticated remote attacker full administrative control over the Cisco ISE device, including access to the web-based management interface and the ability to execute commands with root privileges. Given that Cisco ISE is a central identity and network access control platform, compromise can enable lateral movement across the entire network, manipulation of authentication policies, creation of rogue administrator accounts, and exfiltration of sensitive identity and network configuration data. The CVSS scope is rated as "Changed," reflecting that the impact extends beyond the ISE device itself to all systems and users whose access is governed by the compromised ISE infrastructure (Cisco Advisory, CISA KEV).

CVE-2026-76460 is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, with a remediation due date of September 19, 2026 — an unusually short three-day window reflecting the severity of active exploitation (CISA KEV). The vulnerability is rated as automatable with total technical impact by NVD SSVC analysis, meaning exploitation can be scripted at scale without manual intervention. No public proof-of-concept code has been confirmed, but exploitation has been reported across multiple threat intelligence sources and security media (BleepingComputer, The Hacker News). The EPSS score is currently 0.0 (likely not yet updated to reflect active exploitation), and no specific threat actor attribution has been publicly confirmed. CISA's BOD 26-04 forensic triage requirements apply, indicating the agency considers the risk of persistent compromise to be high.

1. Reconnaissance: Identify internet-facing or network-accessible Cisco ISE or ISE-PIC instances using tools such as Shodan, Censys, or internal network scanning. Target versions 3.1 (p8–p11), 3.2 (p7–p10), 3.3 (Patch 1–11), 3.4 (base–Patch 6), 3.5 (base–Patch 3), or ISE-PIC 3.4.0/3.5.0.
2. Identify the vulnerable API endpoint: Determine the specific API endpoint on the ISE management interface that lacks proper authentication enforcement (the exact endpoint is not publicly disclosed by Cisco, but is accessible via the web-based management interface).
3. Craft a malicious request: Construct an HTTP request that exploits the incorrect use of privileged APIs (CWE-648) — sending the request in a manner that bypasses the authentication check, potentially by manipulating headers, parameters, or request structure to invoke the privileged API without credentials.
4. Bypass authentication: Submit the crafted request to the target ISE API endpoint. The insufficient authentication control allows the request to be processed as if it were authenticated, granting access to the management interface.
5. Achieve root-level access: Leverage the unauthorized management access to execute administrative actions, escalate to root command execution, modify network access policies, create backdoor accounts, or exfiltrate configuration and identity data (Cisco Advisory, CISA KEV).

• Logs: Review ise-kong/access.log for suspicious or unexpected usernames in API requests (e.g., admin#show logging application ise-kong/access.log | include <suspicious_username>); collect support bundles with debug logs and inspect ./ise/logs/apigateway/access.log..gz on every node in the deployment for anomalous entries.
• Network: Unexpected outbound connections from the ISE server to external or unknown IP addresses; unexpected inbound downloads from malicious IP addresses to the ISE device; unusual API calls to management endpoints from untrusted source IPs.
• File System / Process: Evidence of files uploaded from the ISE device to external destinations; presence of unexpected scripts, web shells, or binaries on the ISE filesystem; processes running with root privileges that were not initiated by legitimate administrative activity.
• Configuration: Newly created or modified administrator accounts not associated with known change management activity; unexpected changes to network access policies, authentication rules, or authorization profiles.

Note: Cisco warns that threat actors with root access may remove or hide exploitation evidence on the device itself; cross-referencing external network and firewall logs is strongly recommended (Cisco Advisory).

Cisco has released fixed software versions that address this vulnerability: ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. ISE 3.0 has reached End of Software Maintenance and customers must migrate to a supported release. There are no configuration workarounds that fully address the vulnerability; however, Cisco recommends using infrastructure access control lists (iACLs) as a temporary mitigation to restrict access to the affected API endpoints to trusted management networks only. CISA's BOD 26-04 requires federal agencies to apply mitigations by September 19, 2026, and mandates forensic triage of potentially compromised devices. If exploitation is suspected, Cisco strongly recommends re-imaging affected nodes and restoring from a known-good configuration backup (Cisco Advisory, CISA KEV).

Cisco's PSIRT confirmed active exploitation in the wild and issued an emergency advisory on September 16, 2026, strongly urging immediate upgrades (Cisco Advisory). Security media including BleepingComputer, The Hacker News, and SecurityWeek covered the disclosure prominently, highlighting the maximum CVSS score and the zero-day exploitation context (BleepingComputer, The Hacker News). The vulnerability was part of a broader September 2026 Cisco ISE security hardening disclosure covering nine CVEs, drawing significant attention to the identity infrastructure attack surface (Forkast News). Community discussion on Mastodon and Telegram amplified the urgency, with security researchers noting the particular danger of a CVSS 10.0 authentication bypass in a central identity management platform.