CVE-2026-76460: Critical Cisco ISE Authentication Bypass Under Active Exploitation
Cisco has disclosed a critical authentication bypass vulnerability in Cisco Identity Services Engine (ISE) that organizations should treat as an immediate remediation priority.
Tracked as CVE-2026-76460, the vulnerability carries a CVSS 3.1 score of 10.0 and is already being actively exploited. The flaw affects both Cisco Identity Services Engine and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
For security and network teams, the risk is significant because ISE commonly sits at the center of Network Access Control (NAC) and identity-based access decisions. A compromise of that management plane can give an attacker considerably more than ordinary application access.
What Is CVE-2026-76460?
CVE-2026-76460 is an authentication bypass vulnerability in a Cisco ISE API.
According to Cisco, the flaw results from insufficient authentication controls on an API endpoint. An unauthenticated remote attacker can send a specially crafted request to the vulnerable endpoint and bypass the web-based management interface's authentication controls.
The CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In practical terms, exploitation can be performed remotely over the network, requires no existing privileges, requires no user interaction, has low attack complexity, and can result in high impact to confidentiality, integrity, and availability.
More importantly, Cisco states that successful exploitation may allow threat actors to obtain command execution with root privileges.
That last point changes the incident-response calculation. Organizations should not treat this solely as an authentication issue. A successfully compromised node may need to be considered fully controlled by the attacker.
Which Cisco ISE Versions Are Affected?
Cisco states that the vulnerability affects Cisco ISE and ISE-PIC regardless of device configuration. Customers should update to at least the following fixed releases:
3.1 → 3.1 Patch 12
3.2 → 3.2 Patch 11
3.3 → 3.3 Patch 12
3.4 → 3.4 Patch 7
3.5 → 3.5 Patch 4
Cisco ISE 3.0 has reached the end of software maintenance, and Cisco advises customers still running it to migrate to a supported release containing the fix.
There is no workaround that fixes the vulnerability. Cisco does, however, recommend infrastructure access control lists, or iACLs, as a temporary mitigation to restrict management and control-plane traffic reaching affected systems.
Active Exploitation Raises the Priority
This is not just a theoretical vulnerability waiting for proof-of-concept code, as Cisco PSIRT has confirmed active exploitation of CVE-2026-76460 and says the vulnerability was discovered while resolving a Cisco Technical Assistance Center support case.
That means organizations should treat patching and compromise assessment as parallel activities. Updating a vulnerable appliance closes the vulnerability, but it does not establish that the appliance was never compromised before the update.
How Defenders Should Investigate Cisco ISE
Cisco recommends reviewing ise-kong/access.log for suspicious usernames and performing the check on every node in a distributed ISE deployment. Additional API gateway access logs can also be collected through a support bundle.
Defenders should also review telemetry outside the appliance, including firewall and network logs, for activity such as unexpected uploads to external IP addresses or downloads from suspicious infrastructure.
That external visibility matters because root-level access gives an attacker the ability to alter or remove evidence stored on the compromised system.
Cisco goes further: when malicious activity is suspected, the company recommends re-imaging affected nodes and restoring configuration from backup as necessary rather than assuming local cleanup is sufficient.
A practical response sequence is:
Identify every Cisco ISE and ISE-PIC node and its current software version.
Upgrade vulnerable systems to Cisco's fixed releases.
Restrict management-plane exposure with appropriate infrastructure ACLs.
Review access logs across every node for suspicious authentication activity.
Correlate ISE activity with firewall and other external network telemetry.
If compromise is suspected, preserve evidence and follow Cisco's guidance to re-image affected nodes.
The Broader Lesson: Identity Infrastructure Is Security Infrastructure
CVE-2026-76460 is another reminder that identity systems cannot be treated as administrative plumbing.
Authentication, Authorization, & Accounting (AAA), privileged access, Network Access Control, and identity policy increasingly determine what users and systems can reach across an enterprise. Compromising the infrastructure enforcing those decisions can undermine controls far beyond a single application.
That makes identity security a shared responsibility across networking, security engineering, IAM, and incident-response teams. INE's Certified Identity & Access Management Associate (eIAMA) addresses practical IAM skills across authentication, authorization, privileged access, monitoring, governance, and identity architecture. INE also provides hands-on cybersecurity training and networking training for teams responsible for securing the infrastructure connecting identities to enterprise resources.
For CVE-2026-76460 specifically, however, the immediate priority is straightforward: inventory, patch, investigate, and do not assume patching alone rules out prior compromise.
FAQ
Is CVE-2026-76460 being actively exploited?
Yes. Cisco PSIRT confirmed active exploitation as of its September 16, 2026 advisory.
Does CVE-2026-76460 require authentication?
No. Cisco describes the vulnerability as remotely exploitable by an unauthenticated attacker.
Is there a workaround?
No complete workaround is available. Cisco recommends restricting management and control-plane access with infrastructure ACLs as a temporary mitigation while affected systems are upgraded.
Can exploitation lead to root access?
Cisco states that successful exploitation may allow attackers to obtain command execution with root privileges.
Share this post with your network
