{"id":"CVE-2026-76460","kind":"vulnerability","aliases":["CVE-2026-76460"],"related":[],"title":"A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to…","description":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Unauthenticated remote attacker bypasses authentication via an API endpoint with insufficient access control and reaches the ISE web management interface; may lead to root command execution. Affects ISE and ISE-PIC regardless of configuration. Actively exploited; Cisco advisory published 2026-09-16, bug CSCww39530.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-16T00:00:00+00:00","products":[{"name":"Cisco Identity Services Engine","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Cisco Identity Services Engine","fixed":["3.1 Patch 12","3.2 Patch 11","3.3 Patch 12","3.4 Patch 7","3.5 Patch 4"],"affected":"3.0 through 3.5 before fixed patches","ecosystem":"vendor"},{"name":"Cisco ISE Passive Identity Connector","fixed":["3.1 Patch 12","3.2 Patch 11","3.3 Patch 12","3.4 Patch 7","3.5 Patch 4"],"affected":"3.0 through 3.5 before fixed patches","ecosystem":"vendor"},{"name":"cisco identity services engine","fixed":[],"affected":"= 3.1.0","ecosystem":"vendor"},{"name":"cisco identity services engine","fixed":[],"affected":"= 3.2.0","ecosystem":"vendor"},{"name":"cisco identity services engine","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"cisco identity services engine","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"cisco identity services engine","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"cisco identity services engine passive identity connector","fixed":[],"affected":"= 3.1.0","ecosystem":"vendor"},{"name":"cisco identity services engine passive identity connector","fixed":[],"affected":"= 3.2.0","ecosystem":"vendor"},{"name":"cisco identity services engine passive identity connector","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"cisco identity services engine passive identity connector","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-bypass","cisco-ise","exploited","infrastructure","network-access-control","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check ISE version and patch level on every node (show version / show application version ise). Review access.log on each node: 'show logging application ise-kong/access.log' for suspicious usernames. Older logs: support bundle with debug logs, look in ./ise/logs/apigateway/access.log.<date>.gz. Also check firewall logs for unexpected uploads to external IPs.","fix":"Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. ISE 3.0 is end of maintenance: migrate to a fixed supported release. No workaround; temporary mitigation is infrastructure ACLs allowing only required management/control-plane traffic. If compromise suspected, Cisco recommends re-imaging nodes and restoring from config backup.","status":"open","published_at":"2026-09-16T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:29+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T20:31:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply Cisco's vendor mitigations or patch for CVE-2026-76460 as listed in the CISA KEV entry; the affected and fixed versions are not stated in the sources.\nIf no mitigation is available, CISA says to discontinue use of the product.","summary":"Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector contain a flaw where privileged APIs are used incorrectly, letting an unauthenticated remote attacker bypass the web management interface. An attacker gets unauthorized access to the affected device, and CISA confirms it is being exploited in the wild.","category":"infrastructure","who_cares":["cisco-ise","network-access-control","self-hosted"],"confidence":0.7,"analyst_note":"Pull Cisco's advisory for CVE-2026-76460 to get affected and fixed versions, exposure checks, and the vendor mitigation steps; the KEV entry at cisa.gov does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"critical"},"cost_usd":0.000417,"input_tokens":2265,"output_tokens":381,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Pull Cisco's advisory for CVE-2026-76460 to get affected and fixed versions, exposure checks, and the vendor mitigation steps; the KEV entry at cisa.gov does not list them.","search":"'-04':207C,233C,264C '-09':141B '-16':142B '-2026':19A,22A '-76460':20A,23A '2026':140B '26':206C,232C,263C 'access':95B,111B,177C 'accord':196C 'action':192C 'activ':135B 'adher':260C 'advisori':138B 'affect':126B,180C 'allow':13A,169C 'api':5A,107B,165C 'appli':193C 'applic':230C 'asset':254C 'attack':17A,102B,173C 'auth':86B 'auth-bypass':85B 'authent':104B 'base':187C,211C 'bod':205C,231C,262C 'bug':143B 'bypass':87B,103B,183C 'cisa':190C,203C,220C 'cisco':7A,24A,28A,32A,37A,41A,45A,49A,53A,57A,64A,71A,78A,89B,137B,145C,151C 'cisco-is':88B 'cloud':236C 'command':124B 'complianc':201C 'configur':134B 'connector':36A,63A,70A,77A,84A,155C 'contain':159C 'control':96B,112B 'could':12A,168C 'cscww39530':144B 'cve':18A,21A 'devic':181C 'discontinu':239C 'endpoint':108B 'engin':10A,148C 'engine':27A,31A,40A,44A,48A,52A,56A,60A,67A,74A,81A 'ensur':200C,259C 'evalu':252C 'execut':125B 'exploit':91B,136B 'exposur':257C 'follow':229C 'forens':222C 'gain':175C 'guidanc':218C,234C 'guidelin':266C 'host':99B 'ident':8A,146C,154C 'identity':25A,29A,35A,38A,42A,46A,50A,54A,58A,62A,65A,69A,72A,76A,79A,83A 'incorrect':161C 'infrastructur':92B 'instruct':199C 'insuffici':110B 'interfac':119B,189C 'internet':256C 'ise':11A,33A,90B,116B,127B,130B,149C,152C,157C 'ise-p':129B,156C 'lead':121B 'manag':118B,188C 'may':120B 'mitig':194C,245C 'network':94B 'network-access-control':93B 'note':217C,228C 'passiv':153C 'passive':34A,61A,68A,75A,82A 'patch':265C 'pic':131B,158C 'priorit':208C 'privileg':164C 'product':243C 'publish':139B 'reach':114B 'regardless':132B 'remot':16A,101B,172C 'requir':191C,224C 'respons':250C 'risk':213C 'root':123B 'secur':209C 'see':214C,225C 'self':98B 'self-host':97B 'servic':9A,147C,237C 'services':26A,30A,39A,43A,47A,51A,55A,59A,66A,73A,80A 'stakehold':248C 'triag':223C 'unauthent':15A,100B,171C 'unauthor':176C 'unavail':247C 'updat':210C 'url':215C,226C 'use':162C,240C 'vendor':198C 'via':105B 'vulner':2A,166C 'web':117B,186C 'web-bas':185C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T00:00:00+00:00","kev":{"dateAdded":"2026-09-16","dueDate":"2026-09-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-76460","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460","severity":null,"published_at":"2026-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T21:35:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76460:84","url":null,"severity":null,"published_at":"2026-10-23T21:28:12+00:00","modified_at":"2026-10-23T21:28:12+00:00","first_seen_at":"2026-10-23T21:28:12+00:00","fetched_at":"2026-10-23T21:28:12+00:00","note":"Read Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 (CVSS 10.0, exploited per Cisco PSIRT and KEV). No public PoC seen. Unverified: one secondary source mentions a separate CVE-2026-76423."},{"source":"nvd","external_id":"CVE-2026-76460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76460","severity":null,"published_at":"2026-09-16T21:17:21+00:00","modified_at":"2026-10-07T19:17:40+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1027,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-ISE-ABP-VNSW7Tn5.html","title":"Cisco SA: ISE authentication bypass cisco-sa-ISE-ABP-VNSW7Tn5","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1028,"url":"https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/","title":"Help Net Security: Cisco ISE CVE-2026-76460","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}