CISA Warns of Cisco Identity Services Engine Authentication Bypass Vulnerability (CVE-2026-76460)
CISA added actively exploited Cisco ISE authentication bypass CVE-2026-76460 to its KEV catalog, urging patches by September 19, 2026.
Cisco patched CVE-2026-76460, a critical authentication bypass in Cisco Identity Services Engine and ISE Passive Identity Connector caused by insufficient authentication controls on an API endpoint. An unauthenticated remote attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and set a September 19, 2026 remediation deadline. Fixed releases span ISE 3.1 Patch 12 through 3.5 Patch 4; release 3.0 is end-of-maintenance and requires an upgrade.
- Flaw stems from insufficient authentication controls on an API endpoint, allowing unauthenticated management interface access.
- Affects Cisco ISE and ISE-PIC regardless of configuration; fixed in patches for releases 3.1 through 3.5.
- CISA set a September 19, 2026 remediation deadline; ISE 3.0 requires upgrade to a supported release.
- Defenders can check ise-kong/access.log for suspicious usernames; Qualys QID 317886 detects vulnerable assets.
- CVEs
- CVE-2026-76460
- Vendors
- Cisco
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
From the original article
2 min read at threatprotect.qualys.comCisco released security updates to address a critical severity vulnerability in Cisco Identity Services Engine. Tracked as CVE-2026-76460, successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to bypass authentication. Cisco mentioned in their advisory that they are aware of active exploitation of this vulnerability.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.