60
50
60
60
U.S. CISA adds Cisco ISE and PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog
60
60
60
Cisco warns of max severity ISE zero-day exploited in attacks
Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.
CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.
84
Cisco Identity Services Engine Authentication Bypass Vulnerabilities
Cisco fixed multiple authentication bypass flaws in Identity Services Engine and ISE-PIC enabling remote data access, manipulation, and certificate material disruption.
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to access or manipulate data, obtain sensitive information, or cause a reload of certificate and key material on affected devices. Cisco has released software updates, and no workarounds are available. The advisory is part of Cisco's September 2026 publication batch.
38
Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities
Cisco fixed multiple authenticated SQL and HQL injection flaws in Identity Services Engine and ISE-PIC APIs allowing arbitrary database queries and unauthorized data access.
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE-PIC stem from insufficient validation of user-supplied input to affected APIs before it is used to build database queries. An authenticated, remote attacker can send crafted requests to execute arbitrary SQL or HQL queries against the underlying database, viewing or modifying data they are not authorized to access. Cisco has released software updates.
30
Cisco Identity Services Engine Vulnerabilities
Cisco patched ISE and ISE-PIC flaws enabling REST API authentication bypass, remote code execution, SQL injection, and XXE attacks.
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to bypass authentication to the REST API, achieve remote code execution, perform SQL injection, and conduct XML External Entity injection attacks. Cisco has released software updates; no workarounds address these vulnerabilities.
48
Cisco Identity Services Engine Authorization Bypass Vulnerabilities
Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.
26
Cisco Identity Services Engine Multiple Path Traversal Vulnerabilities
Cisco ISE and ISE-PIC contain multiple path traversal vulnerabilities allowing remote attacks; fixes released with no workarounds available.
Multiple path traversal vulnerabilities in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) could allow a remote attacker to conduct path traversal attacks on affected devices. Cisco has released software updates that address these vulnerabilities, and no workarounds are available. The advisory is part of a grouped set of September 2026 ISE advisories.
30
CISA Warns of Exploited Vulnerabilities in Cisco Products
60
60
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
Cisco urgently patched actively exploited zero-day CVE-2026-76460 (CVSS 10.0), an ISE authentication bypass enabling root command execution; CISA added it to KEV.
Cisco released emergency patches for CVE-2026-76460 (CVSS 10.0), a zero-day authentication bypass in an API endpoint of Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), and confirmed active exploitation in the wild. Successful exploitation lets attackers bypass the web-based management interface and execute commands with root privileges, allowing them to hide or delete indicators of compromise. Fixed releases are ISE/ISE-PIC 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, and 3.1 Patch 12; no workarounds exist beyond restricting traffic with infrastructure ACLs. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving US federal agencies three days to patch under BOD 26-04.
88
Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
60
60
60
Cisco Identity Services Engine Hardening Release: September 2026
Cisco ISE hardening release fixes multiple internally discovered vulnerabilities, including an authentication bypass known to be actively exploited.
Cisco released September 2026 hardening updates for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) following a comprehensive internal security review that uncovered multiple vulnerabilities. One of the flaws, an ISE authentication bypass, is known to be actively exploited. Cisco grouped the issues by underlying vulnerability to help customers prioritize patching and streamline disclosure.
58
Cisco Identity Services Engine Command Injection Vulnerabilities
Authenticated attackers with admin credentials could exploit Cisco ISE command injection flaws to execute arbitrary commands as root; fixes released.
Multiple command injection vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as the root user. Cisco has released software updates, and no workarounds are available. The advisory is part of a grouped set of September 2026 ISE advisories.
30
60
Cisco fixed four critical flaws in Identity Services and Webex
60
60
60
60