CVE-2026-76460: Cisco ISE Auth Bypass Zero-Day

CVE-2026-76460: Cisco ISE Auth Bypass Zero-Day | 2026

Executive Summary

Since September 16, 2026, the critical CVE-2026-76460 vulnerability in Cisco Identity Services Engine (ISE) has become an active zero-day risk for organizations that rely on Cisco ISE or Cisco ISE Passive Identity Connector (ISE-PIC) to enforce identity-aware network access. Cisco rates the flaw at CVSS 10.0, says exploitation is active, and has released fixed software for supported 3.x branches.

The issue is an unauthenticated authentication bypass in an ISE API endpoint. A remote attacker can send crafted requests that bypass the web-based management interface and gain unauthorized access to the affected device. Cisco also warns that successful exploitation may lead to command execution with root privileges, which raises the stakes from management-plane exposure to full appliance compromise.

This is a patch-first incident. There are no workarounds that fully address CVE-2026-76460. Cisco recommends upgrading to the fixed releases, limiting management and control-plane traffic with infrastructure ACLs, and checking every node in distributed deployments for suspicious access.log entries.

---

The Flaw: Authentication Bypass in Cisco ISE

CVE-2026-76460 is a critical-severity authentication bypass vulnerability (CVSS 10.0) in Cisco ISE and Cisco ISE-PIC. Cisco says the weakness exists because an API endpoint does not apply sufficient authentication controls.

The affected products are:

Product	Exposure	Configuration dependency
Cisco Identity Services Engine (ISE)	Affected	None. Cisco says the flaw applies regardless of configuration.
Cisco ISE Passive Identity Connector (ISE-PIC)	Affected	None. Cisco says the flaw applies regardless of configuration.

The risk is especially serious because ISE sits close to enterprise identity and access management, network admission, device posture, and policy enforcement. A compromise of that management plane can give attackers a privileged vantage point into access policy and connected infrastructure.

How the Exploit Works

1. Reach the exposed API surface: The attacker targets an affected Cisco ISE or ISE-PIC node where management traffic is reachable.
2. Send a crafted request: The attacker sends a request to the vulnerable API endpoint.
3. Bypass authentication: Because the endpoint lacks sufficient authentication control, the request can bypass the web-based management interface.
4. Gain unauthorized access: The attacker gains access to the affected device.
5. Escalate impact: Cisco warns that successful exploitation may allow command execution with root privileges, enabling attackers to hide or delete evidence.

Cisco provided a non-exhaustive example for checking for suspicious usernames in access.log:

admin#show logging application ise-kong/access.log | include dummyuser

For distributed deployments, defenders should run log review across every node, not only the primary administrative node. Cisco also recommends collecting support bundles with debug logs when additional access.log files are needed.

The patch, released in Cisco's September 16, 2026 advisory set, addresses the authentication bypass in the affected API. However, because Cisco has confirmed active exploitation and CISA added the CVE to the Known Exploited Vulnerabilities catalog, organizations should treat delayed patching as active exposure.

---

What Is the CVE-2026-76460 Exploitation Timeline?

Date	Event	Status
September 16, 2026	Cisco publishes the advisory for CVE-2026-76460 and releases fixed software.	Patch available
September 16, 2026	Cisco PSIRT confirms awareness of active exploitation.	Active exploitation
September 16, 2026	CISA adds CVE-2026-76460 to the KEV catalog.	Federal remediation clock starts
September 17, 2026	Independent security media report the zero-day and emergency patch guidance.	Public disclosure expands
September 19, 2026	Federal Civilian Executive Branch agencies face CISA's required remediation deadline.	Mandatory patch deadline

---

Who Is Exploiting CVE-2026-76460?

Cisco has not publicly attributed the exploitation to a named threat actor, campaign, or country-nexus group. That lack of attribution should not reduce urgency: Cisco ISE appliances are high-value management systems, and the vulnerability requires no authentication.

From a defender's perspective, the most important assumption is that exploitation evidence may be incomplete. Cisco warns that root-level access could allow threat actors to remove or hide indicators of compromise. That means local logs are useful, but they should be corroborated with network, firewall, proxy, and file-transfer telemetry outside the ISE appliance.

---

Why This Matters: Network Access Control Is a High-Trust Target

Cisco ISE is commonly used to make access decisions across wired, wireless, VPN, guest, and device posture workflows. That makes the appliance more than another web console. It can influence who and what is allowed onto sensitive network segments.

Key Challenges

1. Management-plane exposure: If the ISE management surface is reachable from broad internal networks or the internet, the exploitation path becomes easier.
2. Root-level cleanup risk: Cisco's warning about possible root command execution means attackers may tamper with evidence on the device.
3. Distributed deployment complexity: Large ISE deployments often include multiple nodes. A clean primary node does not prove the full deployment is clean.
4. Trust concentration: ISE integrates with directories, devices, policy sets, certificates, and network enforcement points. Compromise can create follow-on risk even when the original bug is patched.

This is where access control and network segmentation matter operationally. The faster defenders reduce management access to only required sources, the less room attackers have to reach the vulnerable endpoint.

---

Defensive Posture: Immediate Actions

Critical Priority: Patch Cisco ISE and ISE-PIC

Upgrade affected deployments to the fixed releases:

Cisco ISE or ISE-PIC release	First fixed release
3.1	3.1 Patch 12
3.2	3.2 Patch 11
3.3	3.3 Patch 12
3.4	3.4 Patch 7
3.5	3.5 Patch 4

Cisco ISE 3.0 has reached end of software maintenance, so organizations still running 3.0 should migrate to a supported release that includes the fix.

Restrict Management Traffic

Cisco says there are no workarounds that address CVE-2026-76460, but it recommends infrastructure access control lists as a mitigation. Limit management and control-plane traffic destined to ISE only to required administrative sources.

Recommended controls:

• Restrict ISE management interfaces to dedicated admin networks.
• Block broad east-west access to ISE management ports.
• Review VPN, jump host, and privileged admin paths into ISE.
• Confirm firewall rules match the current ISE node inventory.

Hunt for Suspicious Access Log Entries

Cisco recommends reviewing access.log for suspicious usernames on every node. Start with Cisco's example, then broaden the hunt around unusual usernames, unexpected API paths, and abnormal source IPs.

show logging application ise-kong/access.log | include dummyuser

If suspicious activity appears, Cisco recommends re-imaging affected nodes and restoring from configuration backup if needed. Treat this as an incident response workflow rather than a routine patch task.

Cross-Check Logs Outside the Appliance

Because attackers may gain root privileges and hide local evidence, review telemetry that the ISE appliance cannot alter:

• Firewall logs for unexpected inbound management access.
• Proxy or egress logs for unusual uploads from ISE nodes.
• Network flow logs for ISE connections to unfamiliar external IP addresses.
• Authentication and administrator activity logs around the exploitation window.

Example Splunk hunt for unexpected outbound traffic from ISE nodes:

index=network sourcetype=firewall
src_ip IN ("<ISE_NODE_1>", "<ISE_NODE_2>", "<ISE_NODE_3>")
| where action="allowed"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, app
| sort - count

Example Microsoft Sentinel query for new source IPs reaching ISE management services:

CommonSecurityLog
| where DestinationIP in ("<ISE_NODE_1>", "<ISE_NODE_2>", "<ISE_NODE_3>")
| where DestinationPort in (443, 8443, 9060)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count() by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

---

Indicators of Compromise and Investigation Notes

Cisco has not published a broad IoC list for this issue. The most concrete hunting guidance is behavioral and log-based:

Signal	Why it matters	Where to check
Suspicious usernames in access.log	Cisco's primary exploitation check	Every ISE and ISE-PIC node
Unexpected uploads from ISE	Possible data staging or exfiltration	Firewall, proxy, NetFlow
Downloads from malicious or unfamiliar IPs	Possible tooling or payload retrieval	Firewall, DNS, proxy
Missing or altered local evidence	Possible root-level cleanup	Compare local logs with external telemetry

If exploitation is suspected, preserve evidence before re-imaging where possible, but do not leave an actively compromised ISE node in service longer than necessary. Prioritize containment, clean rebuilds, backup validation, and credential review for connected administrative integrations.

---

Bottom Line

CVE-2026-76460 is a live Cisco ISE zero-day with maximum severity, no full workaround, and potential root-level impact.

Key Takeaways

• Patch immediately: Upgrade to the fixed ISE or ISE-PIC release for your branch.
• Do not rely on configuration safety: Cisco says affected products are vulnerable regardless of device configuration.
• Restrict access now: Use iACLs and firewall policy to limit who can reach ISE management services.
• Hunt beyond the box: Root access may let attackers hide appliance-local evidence, so use independent network and firewall telemetry.
• Treat suspicious logs as compromise: If exploitation is suspected, follow Cisco's re-image and restore guidance.

For Your Clients and Users

Move this to the front of the patch queue. If Cisco ISE helps decide who gets onto your network, a zero-day in that control point deserves same-day action, not a routine maintenance window.

---

References

1. Cisco Identity Services Engine Authentication Bypass Vulnerability
2. Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
3. Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
4. Known Exploited Vulnerabilities Catalog