Cisco confirmed on September 16, 2026, that a maximum-severity Cisco ISE vulnerability is being actively exploited. ISE, short for Identity Services Engine, is the platform most large enterprises use to control who and what gets onto their network, so a bug here doesn’t stay contained to one box.
Tracked as CVE-2026-76460, it carries a CVSS score of 10.0, the highest rating the scale allows, and it lets an unauthenticated attacker walk past authentication entirely on an exposed ISE API endpoint. No password. No token. Just a crafted request.
Here’s the part that should worry defenders more than the score itself: Cisco’s Product Security Incident Response Team (PSIRT) didn’t find this bug in a lab. They found it while resolving a Technical Assistance Center (TAC) support case, which means at least one customer environment was very likely already compromised before the advisory ever went public.
This piece covers what CVE-2026-76460 does, which ISE versions are affected, the fixed releases, and how to check whether your own deployment already shows signs of compromise.
Quick Answer
CVE-2026-76460 is a CVSS 10.0 authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), disclosed by Cisco on September 16, 2026. It lets an unauthenticated, remote attacker send a crafted request to an API endpoint and gain unauthorized administrative access, potentially with root privileges. Cisco has confirmed active exploitation and released fixed software. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day.
What Is CVE-2026-76460?
CVE-2026-76460 is a Cisco authentication bypass vulnerability in an API of Cisco ISE, classified under CWE-648 (Incorrect Use of Privileged APIs) in Cisco’s own advisory. The root cause is insufficient authentication control on an API endpoint.
An attacker sends a crafted request directly to that endpoint and bypasses the web-based management interface’s login controls entirely, without needing any credentials at all. From there, they gain unauthorized access to the ISE device itself. Cisco’s advisory notes that a successful exploit can lead to command execution with root privileges: full control of the underlying operating system, not just the ISE application sitting on top of it.
Why does that matter beyond the obvious? Because ISE sits at the center of network access control, handling 802.1X authentication, device profiling, and posture assessment across an organization’s wired, wireless, and VPN infrastructure. Compromising it doesn’t just expose one server. It hands an attacker the ability to manipulate access policies and pivot into the broader corporate network from a position of trust.
Which Cisco ISE Versions Are Affected?
The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. Cisco’s advisory lists releases 3.1 through 3.5 in its fixed-release table (below); ISE Release 3.0 has already reached End of Software Maintenance, so organizations still running it need to migrate to a supported release rather than wait for a patch.
Fixed Releases: The Patch Table
Cisco has released fixed software for every currently supported release train:
| Cisco ISE / ISE-PIC Release | First Fixed Release |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
There are no workarounds that fully address the vulnerability, and Cisco strongly recommends upgrading to the appropriate fixed release as the primary remediation.
Is There a Workaround?
Cisco’s advisory is blunt about this: there is no workaround that eliminates the risk. There is a mitigation, though. Use infrastructure access control lists (iACLs) to restrict network access so that only required management and control-plane traffic can reach the affected ISE device. That buys time for organizations that can’t patch immediately, but it’s a stopgap, not a substitute for applying the Cisco ISE security update itself.
How to Check for Signs of Compromise
Most coverage of CVE-2026-76460 skips this step. That’s a mistake, given that Cisco itself found this bug through an already-compromised customer environment. Cisco’s advisory recommends:
- Review the
access.logfile on every node in the deployment (in a distributed setup, check each node individually) for suspicious usernames. Cisco gives the example of searching for adummyuser-style entry with a command likeshow logging application ise-kong/access.log | include dummyuser. - Need deeper visibility? Collect a support bundle with debug logging enabled, use shared-key encryption, and decrypt it to review the full API gateway access logs.
- Treat any matching entry as a potential indicator of compromise (IOC). Successful exploitation can grant root-level access, and Cisco warns that attackers may have already removed or hidden evidence on the device itself. So cross-check firewall and network logs outside the affected device too, looking for unexpected outbound uploads or downloads to unfamiliar IP addresses.
- If compromise is suspected, Cisco’s guidance is direct: re-image the affected nodes and restore from a configuration backup.
Why This Is Part of a Bigger Pattern
CVE-2026-76460 didn’t arrive alone. Cisco’s September 16 disclosure also covered two related critical flaws: CVE-2026-20305 and CVE-2026-20306, both CVSS 9.1 command-injection vulnerabilities (in diagnostic tools and the REST API respectively) that require authentication but still allow privilege escalation to root.
A separate batch of six more vulnerabilities went out the same day, including CVE-2026-76423, another CVSS 10.0 REST API authentication bypass. Security researchers at STAR Labs SG, credited with reporting the command-injection pair, had previously flagged a critical command-injection flaw in the same platform back in June 2026.
And this isn’t ISE’s first brush with maximum-severity, unauthenticated bugs, not by a long shot. Cisco disclosed CVE-2025-20281 and CVE-2025-20337, both unauthenticated remote-code-execution flaws in ISE also rated CVSS 10.0, in mid-2025.
Amazon’s threat intelligence team later reported that CVE-2025-20337 had actually been exploited as a Cisco ISE zero day before Cisco ever published the fix. Put it all together and this is at least the third time in roughly a year that Cisco has had to patch an unauthenticated, maximum-severity flaw in the same identity platform.
CyberInfos Analyst Insight
The recurring theme here isn’t just “another CVE.” It’s that identity infrastructure keeps turning up as the weak point in otherwise mature security stacks. ISE is often deployed specifically to enforce zero-trust segmentation, so when the enforcement point itself has an unauthenticated bypass, the security model it was meant to guarantee gets inverted, at least temporarily.
A common mistake we see in the field is treating identity and access platforms as “set and forget” infrastructure once deployed, instead of as high-value targets that need the same patch cadence and monitoring as internet-facing production servers.
Cisco found this specific Cisco ISE vulnerability via a live TAC case, not a routine audit. That alone should push any organization running an internet-reachable or otherwise exposed ISE management interface to treat the compromise-check step above as mandatory, not optional, even after patching.
Statistics & Regulatory Context
CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, the same day it was disclosed. Under CISA’s Binding Operational Directive (BOD) 26-04, a 2026 policy that replaced flat 14-day KEV remediation deadlines with a risk-tiered model, this vulnerability was assigned a remediation deadline of September 19, 2026: a three-day window, reflecting both the unauthenticated attack path and the fact that ISE is frequently internet- or network-reachable.
That deadline applies directly only to U.S. federal civilian agencies. Still, it’s a useful benchmark: under BOD 26-04, only a small minority of KEV entries, roughly 1% in CISA’s own pilot data, receive a three-day deadline, reserved for the highest-risk combination of exposure and impact. Enterprises outside the federal scope should read that tier assignment as a signal of how seriously to prioritize this ISE CVSS 10 patch, not as a government-specific formality that doesn’t concern them.
Actionable Checklist
- Identify every Cisco ISE and ISE-PIC node in your environment, including its current release and patch level
- Cross-reference against the fixed-release table above and schedule upgrades for any node below the listed patch
- For ISE 3.0 deployments, plan a migration to a supported release rather than searching for a patch
- Apply iACLs to restrict management-plane access to ISE as an interim mitigation before patching
- Search
access.logon every node for suspicious usernames per Cisco’s guidance - Cross-check firewall and network logs outside the ISE device for anomalous outbound traffic
- If compromise is suspected, re-image affected nodes and restore from a known-good configuration backup
- Subscribe to Cisco Security Notifications for follow-up advisory updates on this disclosure batch
FAQ
What is CVE-2026-76460?
It’s a CVSS 10.0 authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE-PIC, disclosed by Cisco on September 16, 2026. It lets an unauthenticated, remote attacker bypass authentication on an API endpoint and gain unauthorized access to the device.
Is CVE-2026-76460 being actively exploited?
Yes. Cisco’s PSIRT advisory says it’s aware of active exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day it was disclosed.
What Cisco ISE versions are affected?
Cisco ISE and ISE-PIC releases 3.1 through 3.5 are affected, regardless of device configuration. ISE 3.0 is out of support and should be migrated rather than patched.
What is the fixed release for CVE-2026-76460?
Fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, depending on your current version.
Are there workarounds for CVE-2026-76460?
No workaround fully resolves the issue. Cisco recommends restricting access with infrastructure access control lists (iACLs) as a temporary mitigation until you can patch.
How do I check if my Cisco ISE was compromised?
Review access.log on every ISE node for suspicious usernames, cross-check external firewall and network logs for anomalous traffic, and re-image and restore from backup if you find evidence of exploitation.
What is Cisco ISE used for?
Cisco ISE is a network access control platform that handles authentication, device profiling, and posture assessment for wired, wireless, and VPN endpoints, enforcing an organization’s access policies.
What is the CISA KEV remediation deadline for this vulnerability?
CISA assigned a three-day remediation deadline of September 19, 2026, under its BOD 26-04 risk-tiered model. That deadline applies directly to U.S. federal agencies, but it signals the urgency for any organization running ISE.
Final Thoughts
CVE-2026-76460 is about as serious as CVSS scoring gets: unauthenticated, remotely exploitable, and already under active attack against a platform that many enterprises rely on to enforce network access control in the first place.
The immediate priorities aren’t complicated. Identify every ISE and ISE-PIC node, patch to the fixed release for your track, apply iACLs anywhere you can’t patch immediately, and run the compromise checks above regardless of how fast you patch, since Cisco’s own account suggests exploitation predates the public disclosure.
Longer term, this Cisco ISE vulnerability is another data point that identity infrastructure needs the same patching discipline and monitoring rigor as any other internet-facing production system, not less, given what a compromise of it enables downstream. Subscribe to CyberInfos for updates as this disclosure batch develops.
