Skip to content
NewA calmer, faster ZeroHour
Advisorylow

Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Cisco Security Advisories ()1 · 1 read
Read at sec.cloudapps.cisco.com
Part of a story covered by 14 sourcesCisco ISE September 2026 hardening release fixes actively exploited authentication bypass CVE-2026-76460 plus RCE, SQL injection, XXE and path traversal flawsMerged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.

Key facts
  • Requires valid Administrator credentials to exploit
  • Lack of server-side validation of Administrator permissions
  • Impact limited to modifying file descriptions on specific pages
  • Affects both ISE and ISE Passive Identity Connector (ISE-PIC)
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
authorization-bypassciscoiseise-picpatchweb-management
Vendors
Cisco
Products
Cisco Identity Services Engine (ISE)Cisco ISE Passive Identity Connector (ISE-PIC)
Organizations
Cisco

From the original article

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. These vulnerabilities are due to the lack of server-side validation of Administrator permissions.

Cisco Security Advisories

sec.cloudapps.cisco.com

Read the full article at Cisco Security Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.