# Cisco ISE API authentication bypass, exploited on the network access control plane

Source: https://startwithidentity.com/cves/cve-2026-76460/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-76460 is an authentication bypass in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Cisco says the endpoint had "insufficient authentication control": a crafted request reaches it without logging in and gives the attacker access to the device around the web management interface. Cisco's advisory notes that successful exploitation can give command execution as root. CVSS 3.1 is 10.0. NVD maps it to CWE-648, incorrect use of privileged APIs.

Every configuration is affected. First fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Release 3.0 is past end of maintenance and gets no fix. Cisco published on September 16, 2026, said its PSIRT is aware of active exploitation, and CISA added the CVE to KEV the same day.

## Why it matters

ISE is the policy engine behind 802.1X, [RADIUS](https://startwithidentity.com/cves/radius/) and TACACS+ for wired, wireless and VPN access. It decides which device and which user get onto which network segment, and it holds the Active Directory join and the shared secrets with every network device. Root on ISE means an attacker can rewrite who is allowed in, read the secrets that let switches trust it, and pivot into the directory it binds to. Cisco itself warns that evidence can be wiped from the box.

## What to do

- Upgrade every node in the deployment to the first fixed patch for your train. Move off 3.0.
- Restrict the management and API surface with infrastructure ACLs until you have patched. Cisco lists no workaround.
- Run Cisco's check on every node: `show logging application ise-kong/access.log` and look for unexpected usernames such as `dummyuser`.

## After you patch

- If you find signs of compromise, follow Cisco's advice to re-image and restore from a configuration backup, not clean in place.
- Rotate the AD join account, RADIUS and TACACS+ shared secrets, and admin passwords.
- Check firewall and network logs outside ISE for uploads from the appliance to unknown addresses.

## Sources

- [NVD: CVE-2026-76460](https://nvd.nist.gov/vuln/detail/cve-2026-76460)
- [Cisco security advisory cisco-sa-ISE-ABP-VNSW7Tn5, September 16, 2026](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5)
- [CISA Known Exploited Vulnerabilities catalog, added September 16, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460)