CVE-2026-76460: Critical Cisco ISE Zero-Day Authentication Bypass Exploited in the Wild

Cisco has released emergency security updates for a maximum-severity vulnerability affecting Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) after confirming active exploitation in the wild. Tracked as CVE-2026-76460 and rated 10.0 on the CVSS scale, the flaw allows an unauthenticated remote attacker to bypass authentication and gain unauthorized access to a vulnerable device. The vulnerability resides in an ISE API endpoint that does not enforce sufficient authentication controls. An attacker can send a specially crafted request to the affected API and bypass the web-based management interface without possessing valid administrator credentials. The issue is especially serious because Cisco warns that successful exploitation may ultimately provide attackers with command execution as root. That level of access can allow a threat actor to alter the system and potentially remove or conceal evidence of compromise, complicating forensic investigation. Cisco disclosed the vulnerability on September 16, 2026. The same day, CISA added it to the Known Exploited Vulnerabilities catalog and gave U.S. federal civilian agencies until September 19, 2026 to remediate affected systems. CVE-2026-76460 analysis From a defensive perspective, CVE-2026-76460 analysis starts with the vulnerable management API. Cisco attributes the flaw to insufficient authentication control on an API endpoint, allowing a crafted unauthenticated request to reach functionality that should normally be protected by the web management authentication layer. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This means the issue is network-accessible, has low attack complexity, requires no existing privileges and no user interaction, and may have high impact on confidentiality, integrity, and availability. Cisco classifies the weakness as CWE-648: Incorrect Use of Privileged APIs. The most important details for CVE-2026-76460 are that no special device configuration is required for exposure. Cisco states that the vulnerability affects ISE and ISE-PIC regardless of configuration, meaning organizations cannot rely on disabling an optional feature to remove the vulnerable condition. CVE-2026-76460 affects the following Cisco ISE and ISE-PIC release branches before their respective fixed patches: - 3.1: fixed in 3.1 Patch 12 - 3.2: fixed in 3.2 Patch 11 - 3.3: fixed in 3.3 Patch 12 - 3.4: fixed in 3.4 Patch 7 - 3.5: fixed in 3.5 Patch 4 Cisco ISE 3.0 has reached End of Software Maintenance, and customers still running that branch should migrate to a supported release containing the security fix. At the initial stage, successful exploitation bypasses authentication to the ISE management plane. However, Cisco’s incident-response guidance makes clear that the consequences can extend further. The company warns that attackers who successfully abuse the vulnerability may obtain root command execution on the affected system. Root access significantly changes the incident-response picture. A threat actor could potentially alter local configuration, manipulate logging, access sensitive data available to the appliance, create persistence, or use the compromised identity-security system as a foothold for further activity. Cisco has not publicly disclosed the precise technical sequence by which the initial API authentication bypass progresses to root command execution, so describing a more detailed exploit chain would currently be speculative. Because ISE is used as part of enterprise authentication, authorization, and network-access workflows, compromise can also have broader consequences than a standalone application breach. An attacker controlling the system may gain access to sensitive identity and network-management information and could potentially affect security decisions made through the platform. Cisco discovered the vulnerability while resolving a Technical Assistance Center (TAC) support case. The company has not disclosed the exact date on which the underlying flaw or malicious activity was first identified. The public advisory was released on September 16, 2026. The disclosure therefore represents a zero-day scenario: Cisco confirmed that threat actors were exploiting the weakness before or at the time customers received the public security update. The vendor has not identified the threat actors behind the campaign, their motivations, geographic focus, or the organizations targeted. A reliable public CVE-2026-76460 PoC was not referenced by Cisco or either of the two requested reports at disclosure. Public exploit availability and real-world exploitation are separate issues; in this case, confirmed attackers already possess working exploitation capability even though the vendor has not published the technical request needed to reproduce it. Cisco has, however, provided useful CVE-2026-76460 IOCs and hunting guidance. Administrators should inspect access.log for suspicious usernames and perform the check on every node in a distributed ISE deployment. Cisco provides the following example: admin#show logging application ise-kong/access.log | include dummyuser Any matching entry may indicate malicious activity and requires further investigation. Additional API gateway access logs can be recovered from support bundles and inspected under the ISE log directories. The company also warns that local evidence cannot be treated as complete. Because successful attackers may obtain root privileges, they could delete or modify logs and other artifacts after exploitation. Cisco therefore recommends correlating ISE telemetry with network and firewall logs stored outside the affected device. Security teams should specifically look for unexpected outbound uploads from ISE nodes and downloads from suspicious or malicious IP addresses, as these may provide evidence that survives even if local logs have been tampered with. CVE-2026-76460 Mitigation Cisco states that there are no workarounds that fully remediate the vulnerability. Organizations should upgrade every affected ISE or ISE-PIC node to the appropriate patched release as an emergency action. The required fixed versions are: - Cisco ISE/ISE-PIC 3.1: Patch 12 or later - Cisco ISE/ISE-PIC 3.2: Patch 11 or later - Cisco ISE/ISE-PIC 3.3: Patch 12 or later - Cisco ISE/ISE-PIC 3.4: Patch 7 or later - Cisco ISE/ISE-PIC 3.5: Patch 4 or later The primary CVE-2026-76460 mitigation is patching. Cisco does provide a temporary exposure-reduction measure for organizations that cannot upgrade immediately: infrastructure access control lists, or iACLs, can restrict management and control-plane traffic destined for the affected device to explicitly trusted systems. This network restriction can help prevent arbitrary remote systems from reaching the vulnerable management plane, but Cisco explicitly treats mitigations as temporary and recommends upgrading to fixed software for full remediation. CVE-2026-76460 detection should start with an inventory of all ISE and ISE-PIC nodes and verification of their exact patch level. In distributed deployments, administrators should not patch or inspect only the primary node; Cisco specifically instructs customers to review every node for evidence of attempted exploitation. To Detect CVE-2026-76460 exploitation and post-compromise activity, defenders should investigate: - Suspicious usernames in ise-kong/access.log - Entries matching or resembling the vendor-provided dummyuser example - Unexpected API requests reaching the ISE management plane - New or unexplained administrative activity - Unexpected configuration changes - Unusual command execution on an ISE node - Attempts to delete, truncate, or manipulate application logs - Unexpected uploads initiated by the ISE appliance to external systems - Downloads from suspicious or previously unseen IP addresses - Outbound network connections inconsistent with normal ISE operation - Differences between local ISE logs and firewall, proxy, or network telemetry Because attackers may have root access, the absence of local indicators should not be taken as proof that an exposed system was never compromised. If malicious activity is suspected, Cisco strongly recommends re-imaging affected nodes rather than attempting to clean them in place. Configuration can then be restored from a trusted backup if necessary. Organizations should preserve external evidence before rebuilding the appliance. Firewall logs, NetFlow records, proxy telemetry, DNS data, SIEM events, and other network records can be especially valuable because an attacker with root privileges on ISE may have altered local forensic artifacts. Security teams should also review credentials, secrets, certificates, administrative accounts, and integrations that may have been accessible from a compromised ISE node. If there is evidence that sensitive authentication material was exposed, those credentials should be rotated and downstream systems should be investigated for unauthorized access. CISA’s addition of the vulnerability to KEV reinforces the urgency. The agency categorizes exploitation as active, considers the issue automatable, and assesses its technical impact as total. Given the CVSS 10.0 rating, unauthenticated network attack path, confirmed active exploitation, and potential root access, organizations should treat exposed and unpatched Cisco ISE deployments as an emergency remediation priority rather than waiting for a standard maintenance window. FAQ What is CVE-2026-76460 and how does it work? CVE-2026-76460 is a critical authentication bypass vulnerability in an API endpoint of Cisco Identity Services Engine and ISE-PIC. Insufficient authentication controls allow an unauthenticated remote attacker to send a crafted request, bypass the web-based management interface, and gain unauthorized access to the device. Cisco warns that successful exploitation may ultimately result in root-level command execution. When was CVE-2026-76460 first discovered? Cisco has not disclosed the exact discovery date. The company says the vulnerability was identified while resolving a Cisco TAC support case. Cisco publicly disclosed the flaw and released fixes on September 16, 2026, when active exploitation was already known. What is the impact of CVE-2026-76460 on systems? Successful exploitation initially allows an unauthenticated attacker to bypass management authentication and access the affected ISE or ISE-PIC device. Cisco further warns that attackers may obtain command execution with root privileges, giving them the ability to deeply compromise the appliance and potentially hide forensic evidence. Can CVE-2026-76460 still affect me in 2026? Yes. Cisco ISE and ISE-PIC systems remain vulnerable if they have not been upgraded to the required fixed patch for their 3.1 through 3.5 release branch. The issue is already being exploited in real attacks and is listed in CISA’s KEV catalog. How can I protect myself from CVE-2026-76460? Install Cisco’s fixed patch immediately on every affected ISE and ISE-PIC node. There is no complete workaround. Until patching is finished, restrict management and control-plane access with iACLs. Review access.log and external network telemetry for compromise, and re-image affected nodes if malicious activity is suspected.