CVE-2026-76460Cisco ISE API authentication bypass, exploited on the network access control plane
What broke
CVE-2026-76460 is an authentication bypass in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Cisco says the endpoint had "insufficient authentication control": a crafted request reaches it without logging in and gives the attacker access to the device around the web management interface. Cisco's advisory notes that successful exploitation can give command execution as root. CVSS 3.1 is 10.0. NVD maps it to CWE-648, incorrect use of privileged APIs.
Every configuration is affected. First fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Release 3.0 is past end of maintenance and gets no fix. Cisco published on September 16, 2026, said its PSIRT is aware of active exploitation, and CISA added the CVE to KEV the same day.
Why it matters
ISE is the policy engine behind 802.1X, RADIUS and TACACS+ for wired, wireless and VPN access. It decides which device and which user get onto which network segment, and it holds the Active Directory join and the shared secrets with every network device. Root on ISE means an attacker can rewrite who is allowed in, read the secrets that let switches trust it, and pivot into the directory it binds to. Cisco itself warns that evidence can be wiped from the box.
What to do
- Upgrade every node in the deployment to the first fixed patch for your train. Move off 3.0.
- Restrict the management and API surface with infrastructure ACLs until you have patched. Cisco lists no workaround.
- Run Cisco's check on every node:
show logging application ise-kong/access.logand look for unexpected usernames such asdummyuser.
After you patch
- If you find signs of compromise, follow Cisco's advice to re-image and restore from a configuration backup, not clean in place.
- Rotate the AD join account, RADIUS and TACACS+ shared secrets, and admin passwords.
- Check firewall and network logs outside ISE for uploads from the appliance to unknown addresses.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- CVEFortinet administrative FortiCloud SSO authentication bypass across accounts
An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C