CVE-2026-76460: Critical Cisco ISE Zero-Day Authentication Bypass Exploited in the Wild

CVE-2026-76460

September 17, 2026 · SOCPrime · Severity: CRITICAL

Cisco has released emergency security updates for a maximum-severity vulnerability affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) after confirming active exploitation in the wild. Tracked as CVE-2026-76460 and rated 10.0 on the CVSS scale, the flaw allows an unauthenticated remote attacker to bypass authentication and gain unauthorized access to a vulnerable device. The vulnerability resides in an ISE API endpoint that does not enforce sufficient authentication controls. An attacker can send a specially crafted request to the affected API and bypass the web-based management interface without possessing valid administrator credentials. The issue is especially serious because Cisco warns that successful exploitation may ultimately provide attackers with command execution as root . 📌 **Analyst Note:** This Cisco ISE zero-day carries a CVSS 10.0 rating and is confirmed exploited in the wild. The authentication bypass affects the core network access control appliance, meaning successful exploitation could allow an attacker to completely subvert network segmentation and access policies. Given Cisco ISE's role in 802.1X and MAC authentication bypass enforcement, a compromised ISE appliance effectively grants the attacker unfettered network access. Organizations should treat any Internet-exposed ISE management interface as critically compromised until patched, and review authentication logs for signs of unauthorized administrative sessions dating back to before the patch was released.

The vulnerability resides in an ISE API endpoint that does not enforce sufficient authentication controls. An attacker can send a specially crafted request to the affected API and bypass the web-based management interface without possessing valid administrator credentials.

The issue is especially serious because Cisco warns that successful exploitation may ultimately provide attackers with command execution as root. That level of access can allow a threat actor to alter the system and potentially remove or conceal evidence of compromise, complicating forensic investigation.

Cisco disclosed the vulnerability on September 16, 2026. The same day, CISA added it to the Known Exploited Vulnerabilities catalog and gave U.S. federal civilian agencies until September 19, 2026 to remediate affected systems.

Contact Sales

CVE-2026-76460 analysis

From a defensive perspective, CVE-2026-76460 analysis starts with the vulnerable management API. Cisco attributes the flaw to insufficient authentication control on an API endpoint, allowing a crafted unauthenticated request to reach functionality that should normally be protected by the web management authentication layer.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This means the issue is network-accessible, has low attack complexity, requires no existing privileges and no user interaction, and may have high impact on confidentiality, integrity, and availability. Cisco classifies the weakness as CWE-648: Incorrect Use of Privileged APIs.

The most important details for CVE-2026-76460 are that no special device configuration is required for exposure. Cisco states that the vulnerability affects ISE and ISE-PIC regardless of configuration, meaning organizations cannot rely on disabling an optional feature to remove the vulnerable condition.

CVE-2026-76460 affects the following Cisco ISE and ISE-PIC release branches before their respective fixed patches:

3.1: fixed in 3.1 Patch 12
3.2: fixed in 3.2 Patch 11
3.3: fixed in 3.3 Patch 12
3.4: fixed in 3.4 Patch 7
3.5: fixed in 3.5 Patch 4

Cisco ISE 3.0 has reached End of Software Maintenance, and customers still running that branch should migrate to a supported release containing the security fix.

At the initial stage, successful exploitation bypasses authentication to the ISE management plane. However, Cisco’s incident-response guidance makes clear that the consequences can extend further. The company warns that attackers who successfully abuse the vulnerability may obtain root command execution on the affected system.

Root access significantly changes the incident-response picture. A threat actor could potentially alter local configuration, manipulate logging, access sensitive data available to the appliance, create persistence, or use the compromised identity-security system as a foothold for further activity. Cisco has not publicly disclosed the precise technical sequence by which the initial API authentication bypass progresses to root command execution, so describing a more detailed exploit chain would currently be speculative.

Because ISE is used as part of enterprise authentication, authorization, and network-access workflows, compromise can also have broader consequences than a standalone application breach. An attacker controlling the system may gain access to sensitive identity and network-management information and could potentially affect security decisions made through the platform.

Cisco discovered the vulnerability while resolving a Technical Assistance Center (TAC) support case. The company has not disclosed the exact date on which the underlying flaw or malicious activity was first identified. The public advisory was released on September 16, 2026.

The disclosure therefore represents a zero-day scenario: Cisco confirmed that threat actors were exploiting the weakness before or at the time customers received the public security update. The vendor has not identified the threat actors behind the campaign, their motivations, geographic focus, or the organizations targeted.

A reliable public CVE-2026-76460 PoC was not referenced by Cisco or either of the two requested reports at disclosure. Public exploit availability and real-world exploitation are separate issues; in this case, confirmed attackers already possess working exploitation capability even though the vendor has not published the technical request needed to reproduce it.

Cisco has, however, provided useful CVE-2026-76460 IOCs and hunting guidance. Administrators should inspect access.log for suspicious usernames and perform the check on every node in a distributed ISE deployment.

Cisco provides the following example:

admin#show logging application ise-kong/access.log | include dummyuser

Any matching entry may indicate malicious activity and requires further investigation. Additional API gateway access logs can be recovered from support bundles and inspected under the ISE log directories.

The company also warns that local evidence cannot be treated as complete. Because successful attackers may obtain root privileges, they could delete or modify logs and other artifacts after exploitation. Cisco therefore recommends correlating ISE telemetry with network and firewall logs stored outside the affected device.

Security teams should specifically look for unexpected outbound uploads from ISE nodes and downloads from suspicious or malicious IP addresses, as these may provide evidence that survives even if local logs have been tampered with.

CVE-2026-76460 Mitigation

Cisco states that there are no workarounds that fully remediate the vulnerability. Organizations should upgrade every affected ISE or ISE-PIC node to the appropriate patched release as an emergency action.

The required fixed versions are:

Cisco ISE/ISE-PIC 3.1: Patch 12 or later
Cisco ISE/ISE-PIC 3.2: Patch 11 or later
Cisco ISE/ISE-PIC 3.3: Patch 12 or later
Cisco ISE/ISE-PIC 3.4: Patch 7 or later
Cisco ISE/ISE-PIC 3.5: Patch 4 or later

The primary CVE-2026-76460 mitigation is patching. Cisco does provide a temporary exposure-reduction measure for organizations that cannot upgrade immediately: infrastructure access control lists, or iACLs, can restrict management and control-plane traffic destined for the affected device to explicitly trusted systems.

This network restriction can help prevent arbitrary remote systems from reaching the vulnerable management plane, but Cisco explicitly treats mitigations as temporary and recommends upgrading to fixed software for full remediation.

CVE-2026-76460 detection should start with an inventory of all ISE and ISE-PIC nodes and verification of their exact patch level. In distributed deployments, administrators should not patch or inspect only the primary node; Cisco specifically instructs customers to review every node for evidence of attempted exploitation.

To Detect CVE-2026-76460 exploitation and post-compromise activity, defenders should investigate:

Suspicious usernames in ise-kong/access.log
Entries matching or resembling the vendor-provided dummyuser example
Unexpected API requests reaching the ISE management plane
New or unexplained administrative activity
Unexpected configuration changes
Unusual command execution on an ISE node
Attempts to delete, truncate, or manipulate application logs
Unexpected uploads initiated by the ISE appliance to external systems
Downloads from suspicious or previously unseen IP addresses
Outbound network connections inconsistent with normal ISE operation
Differences between local ISE logs and firewall, proxy, or network telemetry

Because attackers may have root access, the absence of local indicators should not be taken as proof that an exposed system was never compromised.

If malicious activity is suspected, Cisco strongly recommends re-imaging affected nodes rather than attempting to clean them in place. Con

Key Takeaways

Cisco warned of a new zero-day ISE authentication bypass vulnerability with a CVSS score of 10.0 that is being actively exploited in the wild against unpatched Identity Services Engine deployments.
The maximum CVSS severity reflects the flaw's potential to completely bypass authentication on Cisco ISE, compromising network access control for the entire enterprise.
Organizations running Cisco ISE should treat this as an emergency patching priority given active exploitation and the critical role ISE plays in network access policy enforcement.