--- id: "CVE-2026-76460" kind: "vulnerability" aliases: ["CVE-2026-76460"] title: "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to\u2026" severity: "critical" cvss: 10.0 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Cisco Identity Services Engine", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Cisco Identity Services Engine", "fixed": ["3.1 Patch 12", "3.2 Patch 11", "3.3 Patch 12", "3.4 Patch 7", "3.5 Patch 4"], "affected": "3.0 through 3.5 before fixed patches", "ecosystem": "vendor"}, {"name": "Cisco ISE Passive Identity Connector", "fixed": ["3.1 Patch 12", "3.2 Patch 11", "3.3 Patch 12", "3.4 Patch 7", "3.5 Patch 4"], "affected": "3.0 through 3.5 before fixed patches", "ecosystem": "vendor"}, {"name": "cisco identity services engine", "fixed": [], "affected": "= 3.1.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine", "fixed": [], "affected": "= 3.2.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine", "fixed": [], "affected": "= 3.3.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine", "fixed": [], "affected": "= 3.4.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine", "fixed": [], "affected": "= 3.5.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine passive identity connector", "fixed": [], "affected": "= 3.1.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine passive identity connector", "fixed": [], "affected": "= 3.2.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine passive identity connector", "fixed": [], "affected": "= 3.3.0", "ecosystem": "vendor"}, {"name": "cisco identity services engine passive identity connector", "fixed": [], "affected": "= 3.4.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["auth-bypass", "cisco-ise", "exploited", "infrastructure", "network-access-control", "self-hosted"] not_affected_if: ["unknown"] published_at: "2026-09-16T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:28:12+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76460", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to… Unauthenticated remote attacker bypasses authentication via an API endpoint with insufficient access control and reaches the ISE web management interface; may lead to root command execution. Affects ISE and ISE-PIC regardless of configuration. Actively exploited; Cisco advisory published 2026-09-16, bug CSCww39530. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Cisco Identity Services Engine affected ? fixed ? - vendor:Cisco Identity Services Engine affected 3.0 through 3.5 before fixed patches fixed 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 - vendor:Cisco ISE Passive Identity Connector affected 3.0 through 3.5 before fixed patches fixed 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 - vendor:cisco identity services engine affected = 3.1.0 fixed ? - vendor:cisco identity services engine affected = 3.2.0 fixed ? - vendor:cisco identity services engine affected = 3.3.0 fixed ? - vendor:cisco identity services engine affected = 3.4.0 fixed ? - vendor:cisco identity services engine affected = 3.5.0 fixed ? - vendor:cisco identity services engine passive identity connector affected = 3.1.0 fixed ? - vendor:cisco identity services engine passive identity connector affected = 3.2.0 fixed ? - vendor:cisco identity services engine passive identity connector affected = 3.3.0 fixed ? - vendor:cisco identity services engine passive identity connector affected = 3.4.0 fixed ? ## How to check Check ISE version and patch level on every node (show version / show application version ise). Review access.log on each node: 'show logging application ise-kong/access.log' for suspicious usernames. Older logs: support bundle with debug logs, look in ./ise/logs/apigateway/access.log..gz. Also check firewall logs for unexpected uploads to external IPs. ## Fix Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. ISE 3.0 is end of maintenance: migrate to a fixed supported release. No workaround; temporary mitigation is infrastructure ACLs allowing only required management/control-plane traffic. If compromise suspected, Cisco recommends re-imaging nodes and restoring from config backup. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460 - 2026-10-23T21:28:12+00:00 analyst — Read Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 (CVSS 10.0, exploited per Cisco PSIRT and KEV). No public PoC seen. Unverified: one secondary source mentions a separate CVE-2026-76423. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76460 ## Documents - [advisory] Cisco SA: ISE authentication bypass cisco-sa-ISE-ABP-VNSW7Tn5 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-ISE-ABP-VNSW7Tn5.html - [describes] Help Net Security: Cisco ISE CVE-2026-76460 https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/ ## From the sources Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_