Cisco ISE September 2026 hardening release fixes actively exploited authentication bypass CVE-2026-76460 plus RCE, SQL injection, XXE and path traversal flaws

Cisco's September 16, 2026 hardening updates for Identity Services Engine (ISE) and ISE-PIC patch multiple internally discovered vulnerabilities, led by the actively exploited unauthenticated API authentication bypass CVE-2026-76460, which CISA added to its…

On September 16, 2026, Cisco released hardening updates for Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) after a comprehensive internal security review uncovered multiple vulnerabilities, which Cisco grouped by underlying flaw to help customers prioritize patching. The batch includes CVE-2026-76460, an authentication bypass caused by insufficient authentication controls on an API endpoint (classed by Canada's Cyber Centre as CWE-648, incorrect use of privileged APIs) that lets an unauthenticated remote attacker send a crafted request to access the web-based management interface regardless of device configuration. Cisco confirmed active exploitation of this flaw; CISA added it to the Known Exploited Vulnerabilities catalog on September 16, 2026, with a September 19, 2026 remediation deadline. The same release fixes authenticated remote code execution — including command injection flaws that run arbitrary commands as root but require valid administrative credentials — SQL injection (CVE-2026-20282 and CVE-2026-20283, both rated High because attackers can easily reach root from the achieved privilege level; a workaround addresses one of the two), XML External Entity injection, path traversal, and flaws enabling data access or manipulation, sensitive information disclosure, and forced reloads of certificate and key material. Canada's Cyber Centre alert AL26-021 additionally flags CVE-2026-20192 (improper access control, CWE-284) and CVE-2026-76423 (authentication bypass by spoofing, CWE-290), warning that exploitation could grant unauthenticated administrative access to read or modify ISE configuration and identity data. Fixed releases span ISE 3.1 Patch 12 through 3.5 Patch 4; release 3.0 is end-of-maintenance and must be upgraded to a supported release. Cisco states software updates are the only fix for most of the advisories. Defenders are advised to check ise-kong/access.log for suspicious usernames (Qualys QID 317886 detects vulnerable assets), restrict management interfaces via ACLs, segmentation, and trusted admin networks, and reimage suspect nodes restored from known-good backups if compromise is suspected.