CVE-2026-76460 received a CVSS 3.1 score of 10.0, the highest possible rating. The flaw created an authentication bypass risk for organizations using Cisco Identity Services Engine (ISE). Cisco also confirmed that attackers were exploiting it in the wild.
The issue affected ISE and ISE-PIC. An attacker could send an unauthenticated request to an API, with no stolen administrator credentials or user action required. If successful, the attack could allow command execution with root privileges on the appliance. That level of control could put critical network management at risk.
This article covers the September 2026 disclosure, affected versions, and fixed patches. You’ll also learn how to check exposure and choose response steps that can help limit further access. Knowing what the flaw could do helps you set a clear priority for your team.
Key Takeaways
- CVE-2026-76460 carried a critical 10.0 CVSS 3.1 score.
- The affected products were ISE and ISE-PIC.
- Attackers did not need login credentials or user interaction.
- Successful attacks could run commands with root privileges.
- The article reviews fixes, exposure checks, and response options.
What Happened in the Cisco identity services engine authorization bypass
On September 16, 2026, Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5. It described CVE-2026-76460 as an actively exploited flaw in ISE and ISE-PIC. The issue was also listed among known exploited vulnerabilities, raising the urgency for defenders.
Active exploitation and the disclosure
The flaw stemmed from insufficient authentication controls on an API endpoint. The advisory did not explain the underlying implementation, so details beyond that finding remain unknown.
How an unauthenticated request reached management
A remote attacker who could reach the affected service could send a crafted request. That request could trigger an authentication bypass at the web-based management interface, without valid credentials. Cisco did not disclose the exact endpoint or request format, so avoid relying on unverified exploit claims.
The initial access risk was distinct from the possible impact. Successful exploitation could allow command execution with root privileges, giving an attacker control of the appliance. The management interface and its logs may help your team follow vendor guidance as you assess exposure.
Who Was Affected and Which Releases Include the Fix
Cisco identified versions 3.0 through 3.5 of ISE and ISE-PIC as affected, no matter how you configured each appliance. This included deployments with an ise passive identity setup or a passive identity connector.
Check each appliance against the fixed builds
Use Cisco’s Fixed Software table to verify the exact release and patch on every node before you consider the vulnerability resolved. Include ISE-PIC in your inventory; a partial review could leave one node exposed. The issue concerned authentication at the web-based management interface, not a specific network policy or access setting.
| Release branch | First fixed build | Recommended check |
|---|---|---|
| 3.1 | Patch 12 | Confirm 3.1 Patch 12 or a later fixed release |
| 3.2 | Patch 11 | Confirm the patch level on each appliance |
| 3.3 | Patch 12 | Compare the installed build with Cisco’s table |
| 3.4 | Patch 7 | Check every node in the deployment |
| 3.5 | Patch 4 | Verify the exact build before closing review |
Plan a supported upgrade for version 3.0
Version 3.0 had reached End of Software Maintenance. Cisco directed customers to migrate to a supported release that contained the fix. Treat the patch as a priority, then confirm the upgrade across your management infrastructure.
Why a Compromised ISE Appliance Could Put Network Access at Risk
Root-level control could turn one exposed appliance into a wider security concern. The impact would depend on its role, setup, and links to other tools.
Potential root command execution and management-plane compromise
Cisco warned that successful exploitation could allow command execution with root privileges. That level of access may let an attacker change appliance settings or disrupt its management. The vulnerability therefore posed more than a local software risk.
Possible effects on identity policies and network access control
ISE supports authentication for users and devices. It checks security posture, then applies policy to decide which network resources each user or device can reach. If an attacker controlled an ISE deployment, they could potentially alter policy or administrative settings. The result could affect access, depending on the appliance’s role and integrations.
ISE-PIC can collect identity data, such as user-to-IP address mappings, and share it with firewalls or security analytics tools. A compromise could put that data or connected decisions at risk. The scope would depend on the affected node and the systems linked to it.
How to Assess Your Exposure and Look for Signs of Exploitation
Check more than your patch status. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, and required forensic triage. Its federal remediation deadline was September 19. The listing confirmed known exploited activity, but public clues remained limited.
Review API gateway records on each appliance
Inspect the API gateway access log on every node. Cisco named ise-kong/access.log, found in the support bundle at ./ise/logs/apigateway/access.log. Search for “dummyuser,” its non-exhaustive example of suspicious usernames. Also review other suspicious usernames, unusual authentication attempts, and unexpected policy changes. Compare timestamps across logs.
Compare appliance activity with outside telemetry
Match appliance records with firewall, proxy, and network-flow data. Look for unexpected connections, uploads, or downloads linked to the management interface or an API endpoint. This can reveal activity that local logs may not show.
Allow for missing or altered evidence
Cisco, CISA, and NVD published no traditional IoC package for this vulnerability. Since successful exploitation could grant root access, an attacker might alter or remove local evidence. Missing logs do not rule out compromise. Preserve available records and review the wider infrastructure before you close your investigation.
What Organizations Did to Reduce Risk and Respond
A safe response paired a patch with a check for signs of exploitation. The flaw appeared in known exploited vulnerabilities, so covered federal agencies also had to meet CISA’s September 19, 2026, deadline and complete forensic triage. Patching alone did not close the response.
Apply a fixed release and limit management traffic
Cisco reported no workaround that fixed the vulnerability. It advised using infrastructure ACLs to temporarily limit management and control-plane traffic to the management interface. Then apply the first fixed release to each affected deployment: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. This reduces exposure while you complete the upgrade.
Investigate suspected compromise and restore affected nodes
Review logs for unusual authentication attempts, new administrative accounts, policy changes, and changes to certificates trusted by downstream systems. Check related network activity, too. If you suspect command execution or confirm compromise, follow Cisco’s recovery guidance: re-image affected nodes, then restore configuration from a trusted source. This helps rebuild control and reduce the risk of lingering access.
What the Vulnerability Revealed About Identity Infrastructure
A single appliance can shape how people and devices gain access across a large network. That reach makes strong management-plane protection essential, not optional.
Review exposure, integrations, and third-party operators
Cisco Identity Services Engine often connects to authentication platforms, wireless systems, VPNs, network infrastructure, and security tools. ISE-PIC can also collect user-to-IP mappings and share identity data with firewalls and security analytics platforms. A passive identity setup or identity connector may extend those links.
Limit appliance management access to a dedicated administrative network and trusted workstations. Avoid broad internal segments and internet-reachable paths. This helps reduce exposure at the management endpoint and limits the reach of future exploitation.
Ask any MSP, managed-NAC, SASE, or campus provider that operates an appliance on your behalf to confirm patch status for every node. Include shared deployments that support decisions across customer segments. Assess how a compromise of a central policy point could affect connected tools and network access decisions. This review can show where control depends on one system and where you may need stronger safeguards.
Conclusion
CVE-2026-76460 earned a Critical CVSS 3.1 score of 10.0, and Cisco confirmed active exploitation. The authentication bypass affected ISE and ISE-PIC versions 3.0 through 3.5, regardless of configuration. Its presence among exploited vulnerabilities called for swift action.
Install the first fixed patch for your supported branch: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Version 3.0 had reached End of Software Maintenance, so Cisco advised moving to a supported release.
Investigate each node and compare local records with independent network telemetry. Root access may let an attacker alter evidence, so do not rely on appliance logs alone. Prompt patching and careful review can help protect management paths and identity data.
