Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Cisco confirmed CVE-2026-76460, an actively exploited unauthenticated authentication bypass in Cisco ISE APIs, urging immediate patching with no workarounds available.
Cisco confirmed active exploitation of CVE-2026-76460, caused by insufficient authentication control on an ISE API endpoint. A remote, unauthenticated attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access to affected devices. The flaw affects Cisco ISE and ISE-PIC releases 3.0 through 3.5; fixes are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, with no workarounds. Cisco provided IoCs, advises checking access.log for suspicious usernames, cross-checking firewall and network logs, and re-imaging suspect nodes since attackers may delete ISE logs.
- CVE-2026-76460 lets unauthenticated attackers bypass the ISE management interface via API
- Affects ISE and ISE-PIC 3.0-3.5; fixed in patches up to 3.5 Patch 4
- No workarounds; Cisco released IoCs and recommends re-imaging compromised nodes
- Attackers may delete ISE logs, so external network and firewall logs should be checked
- Comes two days after Cisco warned of an actively exploited email gateway zero-day
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76460 | Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending. Do: Upgrade ISE and ISE-PIC to the fixed releases specified in Cisco's security advisory (fixed versions are not provided in the available data); because the flaw is on CISA's KEV list, federal agencies must patch or apply mitigations per BOD 26-04 timelines. Until patched, restrict access to the web-based management interface to trusted administrative networks only, verify no unintended exposure via firewalls/ACLs, and monitor for unauthenticated access attempts against the interface. | 10.0 | — | KEV |
| large≈10,000–100,000 ISE/ISE-PIC appliance deployments worldwide, of which an estimated low thousands have internet-reachable management interfaces |
Full article403 words · extracted from helpnetsecurity.com · click to collapse
Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE).
About CVE-2026-76460
Cisco ISE is an identity-based network access control and policy platform.
It checks connecting users’ identity, profiles devices and checks their security posture, grants users the right type of access, and logs it all.
“[CVE-2026-76460] is due to insufficient authentication control on an API endpoint,” Cisco explained.
By sending a crafted request to it, a remote, unauthenticated attacker may gain unauthorized access to the affected device by simply bypassing the web-based management interface.
What to do?
As per usual, Cisco did not disclose details about the attacks they observed, but has provided indicators of compromise.
“To confirm any attempted exploitation of this vulnerability, review the access.log and look for suspicious usernames. The presence of any entry in the output may indicate malicious activity,” the vendor noted.
“This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed.”
And, since attackers may use the obtained access to delete the solution’s logs, defenders should also “cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”
CVE-2026-76460 affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), releases 3.0 through 3.5. Customers have been advised to upgrade to the first fixed release – 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 – as there are no workarounds that address this vulnerability.
Cisco has also fixed a bucketload of additional Cisco ISE and ISE-PIC vulnerabilities, most reported by outside vulnerability researchers, but some discovered by Cisco during internal security testing with the help of frontier AI models.
Cisco ISE Software Release 3.0 is no longer maintained, and Releases 3.1 and 3.2 get only the critical fixes, so customers are advised to migrate to the supported releases: 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/