Cisco ISE CVE-2026-76460: CVSS 10 Auth Bypass Exploited, in KEV

On 16 September 2026 Cisco published an advisory for CVE-2026-76460, an authentication bypass in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). The same day CISA added it to the KEV catalog with a due date of 19 September. Cisco's PSIRT says it is aware of active exploitation.

ISE sits at the center of network access control, deciding which devices and users get onto the network. A bypass of its management interface is a serious problem on any network that relies on it.

What's affected

• Products: Cisco ISE and ISE-PIC, regardless of device configuration.
• Severity: Critical, CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Cisco bug ID CSCww39530.
• Cause: an API endpoint with insufficient authentication controls lets an unauthenticated remote attacker reach the web management interface. CISA and NVD classify it as incorrect use of privileged APIs (CWE-648).
• Impact: Cisco says successful exploitation can yield root level command execution.
• Discovery: found while resolving a Cisco TAC support case.

First fixed releases:

Cisco lists no workaround. Its interim mitigation is infrastructure ACLs that allow only required management and control plane traffic to the node. CISA's entry carries the forensic triage flag, and ransomware use is listed as unknown.

How to check if you're exposed

First, find your version and patch level on every ISE node, including ISE-PIC deployments:

show version
show application version ise

Then hunt for exploitation. Cisco's advisory gives this check for suspicious usernames:

show logging application ise-kong/access.log | include dummyuser

Run it on every node in a distributed deployment. Any matching entry may indicate malicious activity. To go back further in time, collect a support bundle with debug logs included and shared key encryption. Cisco says the older logs are at ./ise/logs/apigateway/access.log..gz inside the bundle.

Root access can let an attacker remove evidence, so Cisco also recommends checking network and firewall logs for unexpected uploads to external IP addresses or downloads from malicious ones.

What to do now

1. Inventory every ISE and ISE-PIC node and its patch level today.
2. Apply the fixed patch for your release from the table. If you are on 3.0, plan a migration, since there is no fix.
3. Until patched, restrict reachability of the management interface with ACLs so that only required hosts can connect.
4. Run the access.log check on every node and review network logs for odd uploads and downloads.
5. If you suspect compromise, Cisco strongly recommends re-imaging the affected nodes and restoring from a configuration backup if needed.
6. Rotate credentials and shared secrets that ISE holds if a node is found compromised, such as RADIUS and TACACS keys and integration accounts.

Why it matters

Security infrastructure is a high value target because it is trusted and often reachable from many network segments. A compromised policy engine can change who gets access, so its compromise reaches well beyond one server.

Note the timing. CISA listed this on the day of the advisory, so there was no gap between disclosure and a confirmed exploitation record. Plan for patch windows for these systems that can be opened the same day.

Also note that ISE 3.0 gets no fix. Products past their maintenance date turn every new critical bug into a permanent one, which is a good reason to track end of maintenance dates in your inventory next to your CVE lists.

Try it yourself

List every network device and appliance you manage that is exposed to more than one network segment, and for each note its software version and end of maintenance date. The ISE nodes should be near the top of the list.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• NVD CVE-2026-76460