Act nowKnown exploited

Advisory · CVE-2026-76460

Cisco ISE authentication bypass opens the door without a key

An unauthenticated API request can bypass authentication on Cisco Identity Services Engine and ISE Passive Identity Connector, and Cisco warns successful exploitation can lead to root command execution.

Advisory published September 16, 2026Independent summary
Vendor
Cisco
Product
Identity Services Engine
Identifier / CWE
CVE-2026-76460
CWE-648
Action timing
Oct 7, 2026
ELI5

Explain it like I’m five

Cisco ISE has a side entrance that forgets to check IDs. Anyone who knocks on it with the right shape of request walks straight past the guard and can take over the building.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted API request

    An unauthenticated, remote attacker sends a crafted request to a vulnerable ISE API endpoint.

  2. 02Missing auth check

    The endpoint does not enforce authentication before handling the request.

  3. 03Management bypass

    The attacker bypasses the web-based management interface and gains unauthorized access to the device.

  4. 04Root foothold

    Cisco warns that successful exploitation can yield command execution with root privileges.

What happened

On September 16, 2026, Cisco disclosed an authentication bypass in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The Cisco PSIRT states it is aware of active exploitation of the vulnerability, and CISA added it to the Known Exploited Vulnerabilities catalog the same day.

The flaw is insufficient authentication control on an API endpoint. An unauthenticated, remote attacker can send a crafted request to the endpoint and bypass the web-based management interface entirely, gaining unauthorized access to the device regardless of configuration. Cisco warns that successful exploitation can give threat actors command execution with root privileges, at which point they can remove or hide evidence of the intrusion.

Fixed releases are documented in the Cisco advisory: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Cisco ISE Software Release 3.0 has reached end of software maintenance and has no fix; customers must migrate to a supported release. There are no workarounds; the only mitigation is infrastructure ACLs that allow only required management and control-plane traffic to the device.

What to do

  1. Inventory all Cisco ISE and ISE-PIC deployments and identify the software release on each node.
  2. Upgrade to the first fixed release on your train (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4). If you are still on 3.0, plan a migration to a supported release.
  3. While patching is underway, apply infrastructure ACLs so only required management and control-plane traffic can reach the devices.
  4. On every node, review the ise-kong access.log for suspicious usernames, per Cisco’s indicator-of-compromise guidance.
  5. Because Cisco warns that evidence may be wiped after root-level compromise, cross-check external firewall and network logs for unexpected uploads from ISE devices to outside IP addresses or downloads from malicious hosts.
  6. If exploitation is suspected, re-image the affected nodes and restore configuration from backup, then rotate credentials and secrets the device held.
  7. Confirm the fixed release is running and that management access remains restricted after the change.

Management note

This is an actively exploited, unauthenticated, CVSS 10.0 bypass on the system that decides who gets on the network. ISE is both the identity gatekeeper and a high-value target, and Cisco’s own guidance assumes the device may already be owned. Treat the patch and the compromise hunt as a single incident, not as routine patching.