Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.
Cisco confirmed active exploitation of CVE-2026-76460, caused by insufficient authentication control on an ISE API endpoint. A remote, unauthenticated attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access to affected devices. The flaw affects Cisco ISE and ISE-PIC releases 3.0 through 3.5; fixes are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, with no workarounds. Cisco provided IoCs, advises checking access.log for suspicious usernames, cross-checking firewall and network logs, and re-imaging suspect nodes since attackers may delete ISE logs.
- CVE-2026-76460 lets unauthenticated attackers bypass the ISE management interface via API
- Affects ISE and ISE-PIC 3.0-3.5; fixed in patches up to 3.5 Patch 4
- No workarounds; Cisco released IoCs and recommends re-imaging compromised nodes
- Attackers may delete ISE logs, so external network and firewall logs should be checked
- Comes two days after Cisco warned of an actively exploited email gateway zero-day
- CVEs
- CVE-2026-76460
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC | 10.0 | 76% | KEVPoC | KEV |
From the original article
2 min read at helpnetsecurity.com
Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). About CVE-2026-76460 Cisco ISE is an identity-based network access control and policy platform.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.