Hackers Exploit Critical Cisco ISE Flaw to Bypass Authentication and Gain Root Access
Cisco patched CVE-2026-76460, a CVSS 10.0 authentication bypass in ISE and ISE-PIC that can grant unauthenticated attackers root access.
Cisco's advisory cisco-sa-ISE-ABP-VNSW7Tn5 (September 16, 2026) describes CVE-2026-76460, insufficient authentication controls (CWE-648) on an exposed API endpoint in Cisco ISE and ISE-PIC, rated CVSS 10.0. Successful exploitation lets an unauthenticated remote attacker bypass management interface authentication and potentially obtain command-and-control with root privileges, enabling log tampering and persistence. Software updates are available with no workarounds; Cisco urges prioritized patching, log review for suspicious usernames, and reimaging of suspect nodes.
- CVE-2026-76460 scores CVSS 10.0; CWE-648 incorrect use of privileged APIs
- Affects Cisco ISE and ISE-PIC regardless of configuration; Bug ID CSCww39530
- No workarounds exist; only software updates remediate the flaw
- Root-level access could let attackers alter logs and establish persistence
- Cisco recommends checking access.log for suspicious usernames and reimaging suspect nodes
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending. Do: Upgrade ISE and ISE-PIC to the fixed releases specified in Cisco's security advisory (fixed versions are not provided in the available data); because the flaw is on CISA's KEV list, federal agencies must patch or apply mitigations per BOD 26-04 timelines. Until patched, restrict access to the web-based management interface to trusted administrative networks only, verify no unintended exposure via firewalls/ACLs, and monitor for unauthenticated access attempts against the interface. | 10.0 | — | KEV |
| large≈10,000–100,000 ISE/ISE-PIC appliance deployments worldwide, of which an estimated low thousands have internet-reachable management interfaces |
Full article632 words · extracted from gbhackers.com · click to collapse
Cisco has issued an urgent security advisory regarding a critical authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
This vulnerability, tracked as CVE-2026-76460, has a maximum CVSS score of 10.0 and could allow unauthenticated remote attackers to gain unauthorized access to vulnerable devices.
Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 details the vulnerability and was published on September 16, 2026. While Cisco has released software updates to address the issue, no workarounds are currently available. Therefore, administrators should prioritize patching affected deployments.
Critical Cisco ISE Flaw
According to Cisco, the problem originates from insufficient authentication controls on an API endpoint exposed by the affected ISE and ISE-PIC instances. An attacker could send a specially crafted request to this endpoint, bypassing the authentication protections on the web-based management interface.
If exploited, this vulnerability would allow a remote attacker without valid credentials to gain unauthorized access to the affected system. Cisco classifies the issue as CWE-648, which pertains to the incorrect use of privileged APIs or authentication mechanisms.
The CVSS v3.1 vector is: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
This rating reflects the vulnerability’s network-based attack surface, low attack complexity, lack of required privileges, and absence of user interaction. The flaw could impact the confidentiality, integrity, and availability of the ISE appliance, and the scope change indicates that a compromise could extend beyond the vulnerable component.
Affected Cisco Products
Cisco has confirmed that the flaw affects both Cisco ISE and Cisco ISE-PIC, regardless of device configuration. ISE-PIC is used to integrate identity information from enterprise directory and authentication systems into security products and access-control workflows.
Administrators should review the Fixed Software section of Cisco’s advisory to determine whether their installed release is vulnerable and to identify the appropriate upgrade path. Cisco Bug ID CSCww39530 is associated with this vulnerability.
Since no workaround exists, simply restricting management-interface exposure is insufficient as a substitute for applying Cisco’s software updates. Organizations should identify internet-facing, externally accessible, and internally reachable ISE management instances, then prioritize patch deployment based on their exposure and business criticality.
Cisco has provided guidance for identifying potential exploitation attempts. Administrators should inspect the access.log file for suspicious usernames, including unexpected account names linked to API requests.
An example command provided by Cisco is as follows:
admin#show logging application ise-kong/access.log | include dummyuserFor distributed ISE deployments, defenders must inspect logs from every node, not only the primary administration node. Additional access logs can be obtained by collecting a support bundle with debug logs enabled, using shared-key encryption, decrypting the bundle, and reviewing files under:
./ise/logs/apigateway/access.log..gzCisco warns that entries matching suspicious usernames may indicate malicious activity. If compromise is suspected, the company recommends reimaging affected nodes and restoring configurations from known-good backups as necessary.
Cisco has further cautioned that successful exploitation may grant threat actors command-and-control capabilities with root privileges. This level of access could allow attackers to alter logs, remove forensic artifacts, establish persistence, or conceal their activity on the appliance.
Therefore, defenders should not rely solely on evidence stored on the potentially compromised ISE device. Cisco recommends correlating appliance findings with external network telemetry, firewall logs, proxy records, and DNS data.
Security teams should investigate unexpected uploads from ISE appliances to external IP addresses, suspicious inbound downloads, unusual API activity, and anomalous behaviors from administrator accounts.
Organizations should treat CVE-2026-76460 as a high-priority incident related to identity infrastructure. Immediate steps such as patching, conducting enterprise-wide log reviews, correlating external telemetry, reviewing credentials, and preparing to rebuild affected nodes are essential for minimizing the impact of a potential compromise.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/hackers-exploit-critical-cisco-ise-flaw/