[CVE-2026-76460] Critical Cisco ISE Authentication Bypass Vulnerability Exploited in the Wild

Severity
Critical

Detail

Cisco has released security updates to address a critical vulnerability, tracked as CVE-2026-76460, affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerability has a CVSS score of 10.0 (Critical) and is being actively exploited in the wild.

The vulnerability is caused by insufficient authentication control on an API endpoint. An unauthenticated, remote attacker could exploit the vulnerability by sending a crafted request to the affected API endpoint. Successful exploitation could allow the attacker to bypass authentication and gain unauthorized access to the affected device through the web-based management interface.

Cisco stated that successful exploitation could allow threat actors to obtain command execution with root privileges. Because of this level of access, attackers may be able to remove or hide evidence of exploitation and indicators of compromise.

Cisco’s Product Security Incident Response Team (PSIRT) is aware of active exploitation of the vulnerability. Cisco did not disclose details about the nature of the attacks or the threat actors responsible.

CVE ID	Summary	CVSS Score
CVE-2026-76460	A vulnerability in an API of Cisco ISE could allow an unauthenticated, remote attacker to bypass authentication and gain unauthorized access to the affected device through the web-based management interface.	10.0 (Critical)

Affected Products

The vulnerability affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. The affected releases and fixed versions are:

• Cisco ISE 3.1 — Fixed in 3.1 Patch 12
• Cisco ISE 3.2 — Fixed in 3.2 Patch 11
• Cisco ISE 3.3 — Fixed in 3.3 Patch 12
• Cisco ISE 3.4 — Fixed in 3.4 Patch 7
• Cisco ISE 3.5 — Fixed in 3.5 Patch 4

Cisco ISE Software Release 3.0 has reached End of Software Maintenance and customers are advised to migrate to a supported release that includes the fix.

Indicators of Compromise (IOCs)

Cisco recommends reviewing the access.log files for suspicious usernames. For distributed deployments, administrators should review the logs of each node. The following command can be used to identify a suspicious username:

admin#show logging application ise-kong/access.log | include dummyuser

The presence of an entry in the output may indicate malicious activity. If malicious activity is suspected, Cisco recommends re-imaging the affected nodes and restoring from a configuration backup if needed. Cisco also recommends reviewing network and firewall logs outside the affected device for suspicious activity, including unexpected uploads initiated from the affected device to external IP addresses or downloads from malicious IP addresses. This is because successful exploitation can provide attackers with root-level command execution, evidence of exploitation and indicators of compromise may have been removed or hidden.

Recommendation

Cisco strongly recommends that customers upgrade to a fixed software release to remediate CVE-2026-76460. There are no workarounds that address the vulnerability.

As a mitigation, Cisco recommends using infrastructure access control lists (iACLs) to allow only required management and control-plane traffic destined for the affected device. Cisco considers this mitigation a temporary solution until the affected system is upgraded to a fixed release.

Source

https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/