Cisco ISE Auth Bypass Zero-Day CVE-2026-76460 Actively Exploited

Executive Summary

On September 17, 2026, Cisco disclosed a critical zero-day vulnerability, CVE-2026-76460, in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products. The flaw carries the maximum CVSS score of 10.0 and allows for a complete authentication bypass. Cisco's Product Security Incident Response Team (PSIRT) has confirmed active exploitation of this vulnerability in the wild, prompting an emergency patch release. Due to the severity and active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to patch by September 19, 2026. Successful exploitation could grant an attacker root-level command execution, leading to a full system compromise.

Vulnerability Details

The vulnerability, CVE-2026-76460, is an authentication bypass flaw stemming from insufficient authentication controls on a specific API endpoint within the ISE web-based management interface. An unauthenticated, remote attacker can exploit this by sending a specially crafted HTTP request to the vulnerable API. A successful request bypasses all authentication mechanisms, regardless of the device's configuration, granting the attacker unauthorized access. The ease of exploitation—requiring no authentication or user interaction—and the critical nature of ISE as a network access control gatekeeper contribute to its maximum severity rating.

Affected Systems

The vulnerability affects multiple versions of Cisco's network access control solutions. Organizations using the following products should assume they are vulnerable and prioritize remediation:

• Cisco Identity Services Engine (ISE): Releases 3.1, 3.2, 3.3, 3.4, and 3.5
• Cisco ISE Passive Identity Connector (ISE-PIC): Releases 3.0 through 3.5

Cisco has released software updates to address this vulnerability and strongly recommends all customers upgrade to a fixed release. There are no workarounds that can fully mitigate the flaw.

Exploitation Status

Cisco has confirmed that its PSIRT is aware of active, in-the-wild exploitation of CVE-2026-76460. The attackers' specific TTPs have not been fully disclosed, but the goal is to gain unauthorized access to the ISE management interface. Following a successful compromise, attackers could potentially achieve root command execution, allowing them to install backdoors, exfiltrate sensitive network information, or pivot to other parts of the network. The active exploitation led CISA to add the vulnerability to its KEV catalog on September 16, 2026, underscoring the immediate and significant risk to organizations.

Impact Assessment

A successful exploit of CVE-2026-76460 presents a catastrophic risk to an organization's security posture. As ISE is a central component for network authentication, authorization, and accounting (AAA), its compromise effectively dismantles network access controls. An attacker could:

• Gain Full Control: Achieve root-level access to the ISE appliance, allowing them to alter policies, create rogue administrator accounts, or disable security logging.
• Bypass Network Segmentation: Modify network access policies to gain access to sensitive, segmented parts of the network.
• Maintain Persistence: Install malware or backdoors on the ISE appliance, which is a trusted, internal system, making detection difficult.
• Erase Evidence: Delete or modify logs to hide their activities, frustrating incident response efforts.

Given that ISE often holds credentials and configurations for other network devices, its compromise can serve as a powerful launchpad for broader network intrusion.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns which could indicate related activity:

Detection & Response

Defenders should focus on both identifying vulnerable systems and detecting exploitation attempts.

1. Identify Vulnerable Systems: Use asset management systems to identify all instances of Cisco ISE and ISE-PIC and their running versions. Compare these against the affected versions list provided by Cisco.
2. Log Analysis: Scrutinize web access logs for the ISE management interface. Look for unusual URI patterns, requests from unexpected IP addresses, or a spike in 401 Unauthorized or 200 OK responses to API endpoints that don't match legitimate administrative activity. This aligns with D3FEND's Network Traffic Analysis (D3-NTA).
3. User Account Monitoring: Implement continuous monitoring of administrative accounts on ISE. Any new account creation or privilege escalation outside of a standard change window should trigger an immediate alert, as recommended by D3FEND's Domain Account Monitoring (D3-DAM).
4. Incident Response: If compromise is suspected, Cisco advises re-imaging the affected appliance from a trusted source and restoring its configuration from a known-good backup. Preserve logs and a forensic image of the compromised system for investigation.

Mitigation

Patching is the only effective, long-term solution. However, some compensating controls can reduce risk.

1. Patch Immediately: The top priority is to apply the security updates provided by Cisco. This is a Software Update (D3-SU) and is the most critical action.
2. Restrict Access: As a temporary measure, use infrastructure Access Control Lists (iACLs) or firewall rules to strictly limit access to the ISE management interface. Only allow connections from dedicated, secure management workstations or jump hosts. This falls under D3FEND's Inbound Traffic Filtering (D3-ITF).
3. Network Segmentation: Ensure the ISE management interface is on a separate, isolated management network, not exposed to the internet or general user networks. This is a form of Network Isolation (D3-NI).
4. Configuration Hardening: Review and harden ISE configurations according to Cisco's best practices to reduce the attack surface. This aligns with Application Configuration Hardening (D3-ACH).