Cisco Identity Services Engine Authentication Bypass Vulnerability (CVE-2026-76460)

Published: Fri 18 September 2026

Prepared by: Brandon Sawyer, Vulnerability Analyst

Purpose

On 16 September 2026, Cisco disclosed a maximum-severity, unauthenticated authentication bypass vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), assigned CVE-2026-76460. The flaw allows a remote, unauthenticated threat actor to send a crafted request to an affected API endpoint and bypass authentication on the web-based management interface, gaining unauthorized access to the device. Cisco has stated its Product Security Incident Response Team (PSIRT) is aware of active exploitation, and on the same day the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue. No Australian regulator advisory specific to this CVE has been identified at the time of writing. However, Australian organisations running Cisco ISE or ISE-PIC should nonetheless treat patching as an emergency priority, consistent with the vulnerability's maximum severity and confirmed in-the-wild exploitation. 

Vulnerability Details

CVE-2026-76460 is an authentication bypass vulnerability (CWE-648: Incorrect Use of Privilege Management) in an API of Cisco Identity Services Engine. It carries a CVSSv3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Reflecting network-based attack access, low attack complexity, no user interaction, no privileges required, and a scope change that reflects impact beyond the vulnerable component itself.

The vulnerability is due to insufficient authentication control on an API endpoint. A threat actor requires no credentials and no user interaction to exploit the flaw; by sending a specially crafted request to the affected API endpoint, the threat actor can bypass the web-based management interface and gain unauthorized access to the device. Cisco has not published technical detail on the nature or infrastructure of observed attacks, or attributed exploitation to any known actor or group.

The vulnerability affects Cisco ISE and Cisco ISE-PIC, regardless of device configuration. As with the Secure Email Gateway flaw disclosed earlier in September, this vulnerability was identified during the resolution of a Cisco Technical Assistance Center (TAC) support case rather than through a researcher disclosure programme, and Cisco's PSIRT has confirmed it is aware of active exploitation at the time of disclosure.

Cisco has released fixed software for all affected release lines. No workaround exists that fully addresses the vulnerability, though a mitigation is available (see Compensating Controls, below).

Discovery and Disclosure Timeline

Impact

Successful exploitation grants a threat actor unauthorized, unauthenticated access to the affected ISE or ISE-PIC device by bypassing its web-based management authentication. Cisco has further warned that successful exploitation may enable command execution with root privileges, meaning a compromised device can expose:

• Administrative or root-level control of the appliance, including the ability to alter policy, configuration, or install persistence mechanisms
• Because ISE is typically used to enforce network access control and Zero Trust policy, a foothold that could be used to manipulate authentication and authorisation decisions for connected network infrastructure
• A base for lateral movement into connected network access, RADIUS/TACACS+, and identity infrastructure

Cisco has noted that, because successful exploitation may grant root-level access, a threat actor may be able to remove or hide evidence of exploitation, and has recommended administrators cross-check network and firewall logs external to the affected device for signs of suspicious activity, including unexpected uploads to, or downloads from, external or known-malicious IP addresses. Cisco has not published a count or identity of affected customers, nor specific indicators of the tooling or infrastructure used by a threat actor.

Mitigation

Primary Remediation

The primary remediation is to upgrade all Cisco ISE and ISE-PIC deployments to the fixed release for the relevant version:

Cisco ISE Release 3.0 has reached End of Software Maintenance; organisations still running this release should prioritise migration to a supported, patched release. 

As with any pre-authentication, unauthenticated vulnerability under active exploitation, applying the fix closes the entry point but does not remove a threat actor who may already have gained access. Given Cisco's own acknowledgement that exploitation was already occurring at the time of disclosure, organisations should treat any internet-facing or otherwise exposed ISE/ISE-PIC deployment as potentially compromised until logs and other indicators have been reviewed, regardless of how recently the appliance was patched. 

Compensating Controls

Cisco has stated that no workaround fully addresses this vulnerability. Where an immediate upgrade cannot be completed, the following mitigation and general hardening measures can reduce exposure in the interim:

• Apply infrastructure access control lists (iACLs) to permit only required management and control-plane traffic to the affected device; Cisco has confirmed this mitigation prevents remote exploitation of this specific vulnerability
• Restrict inbound access to ISE/ISE-PIC management interfaces to trusted networks only, using firewall rules or an access-control gateway
• Use strong, centralised authentication methods (e.g. SAML or LDAP) for administrator access rather than local accounts, consistent with Cisco's general hardening guidance for this product line

These measures reduce the appliance's exposed attack surface but do not close the underlying authentication-bypass flaw, and will not remove any persistence a threat actor established before the mitigation was applied.

Hardening and Longer-Term Actions

Organisations that identify or cannot rule out compromise should renew credentials and any cryptographic material stored on or accessible to the appliance. If malicious activity is suspected on any node, Cisco strongly recommends re-imaging the affected node(s) and restoring from a known-good configuration backup. For distributed ISE deployments, this should be assessed and applied consistently across every node in the deployment, not just the node initially suspected of compromise.

Detection

Indicators and Log-Based Detection

Cisco has published guidance for identifying potential exploitation attempts via the appliance's access log. These indicators should be treated as a starting point rather than a complete picture:

• Review access.log for suspicious or unexpected usernames, for example using: admin#show logging application ise-kong/access.log | include dummyuser
• If the device is part of a distributed deployment, review the access.log on every cluster node, since exploitation may not be visible from a single node
• Additional access.log files can be obtained by collecting a support bundle with debug logs and shared-key encryption enabled, then decrypting to locate logs at ./ise/logs/apigateway/access.log*.gz
• Because successful exploitation may grant root-level access, a threat actor may be able to remove or alter local log evidence; Cisco recommends cross-checking external network and firewall logs for unexpected outbound uploads or connections to known-malicious infrastructure

Recommended Detection and Hunting Activities

• Review access.log across all ISE/ISE-PIC cluster nodes for unexpected or suspicious usernames, focusing in particular on the period leading up to the 16 September 2026 disclosure
• Cross-correlate any suspicious log entries with firewall and network logs external to the appliance, including for unexpected uploads or downloads to/from external IP addresses
• Ensure centralised, retained logging is in place for ISE/ISE-PIC to support retrospective investigation, given that on-device logs may not be reliable evidence of compromise
• If any indicator is identified, or patching was delayed, treat the environment as potentially compromised: re-image affected nodes, restore from a known-good configuration backup, rotate credentials and cryptographic material accessible to the appliance, and engage incident response
• Organisations that identify suspected exploitation should contact Cisco TAC directly for assistance

This remains an emerging situation, and we urge all organisations running Cisco ISE or ISE-PIC to stay up to date with information from trusted vendor sources as further guidance is published.

MDR customers: Triskele Labs will continue tuning detections and analysing IOCs for behaviours consistent with the exploitation of CVE-2026-76460 across supported log sources. 

Vulnerability Management customers: Environments will be actively assessed for vulnerable versions of Cisco ISE and ISE-PIC affected by CVE-2026-76460. Any findings will be communicated through priority channels. 

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
• https://www.cve.org/CVERecord?id=CVE-2026-76460
• https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
• https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/
• https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
• https://www.csoonline.com/article/4223535/cisco-patches-max-severity-ise-flaw-the-second-critical-zero-day-this-week.html
• https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/