DEV Community

Anoymask
Anoymask

Posted on

Cisco ISE CVE-2026-76460: Pre-authentication Auth Bypass Actively Exploited

#security #threatintel

1. Basic Information

2. Executive Summary

A flaw in the authentication controls of the Cisco ISE and ISE-PIC APIs allowed unauthenticated remote attackers to bypass management authentication using crafted HTTP requests and execute commands with root privileges. Cisco and CISA have confirmed active exploitation in the wild.

3. Attack Flow

From Pre-Authentication API Request to Root Command Execution

  1. An attacker sends a crafted HTTP request over the network to a reachable Cisco ISE or ISE-PIC management API.
  2. The attacker exploits the API authentication flaw to bypass web management interface authentication.
  3. The attacker abuses internal administrative functions to execute commands with root privileges on the appliance.
  4. To hide the intrusion, the attacker may clear local log files and continue subsequent access or configuration modifications.

4. Attacker Position and Execution Location

  • An unauthenticated remote attacker who can send packets over the network to the vulnerable management API.
  • This includes environments directly exposed to the internet as well as attackers positioned to reach the interface from internal networks, VPNs, or operations management segments.

5. Visibility for Victims and Administrators

Victims

  • Inference: Since the attack does not require general user terminal interaction, obvious anomalies may not appear on user screens. The absence of screen anomalies does not prove a lack of compromise.

Administrators

  • Clues include suspicious usernames or unexpected management API calls recorded in the web server access log (access.log), along with unexpected processes running with root privileges. However, if the attacker clears local logs, internal evidence may not remain.

6. Success and Failure Conditions

Success Conditions

  • The attacker can reach the target management API over the network.
  • The security patch has not been applied (whether specific optional features are enabled is irrelevant).

Failure Conditions

  • The security patch is applied completely across all nodes.
  • Infrastructure ACLs (iACLs) prevent the attacker from reaching the management interface by restricting permitted source addresses to trusted management networks. This reduces exposure but does not fix the vulnerability or protect against attackers who already have access through an allowed source.

7. Impact Upon Success

  • Complete bypass of authentication on the web management interface.
  • Execution of arbitrary commands with root privileges on the underlying operating system.
  • Modification of network access control and authentication infrastructure settings, leakage of stored secrets, and loss of overall system trust.

8. Observable Logs

Email

  • This incident is a direct attack on the web management API, and email vector involvement has not been confirmed.

Proxy / SWG / DNS

  • Inference: Review HTTP(S) request and response logs directed to the ISE management API. Public information alone does not establish a pattern that uniquely identifies all attack traffic.

Endpoint / EDR

  • Inference: Check for unexpected process creation, shell execution, and file modifications on the appliance according to official Cisco guidance. Note that because this device is a dedicated appliance, standard EDR agents may not be deployable.

Identity / IdP

  • Inference: Check for suspicious management operations without legitimate ISE management account login records, unnatural gaps in authentication logs, and unauthorized creation of new administrator accounts.

SaaS / Cloud

  • Inference: Review configuration change history in external systems integrated with ISE (server certificates, RADIUS authentication, IdPs, MDM, etc.) and check for exposed shared secrets.

Network

  • Inference: Preserve records external to ISE such as firewalls, reverse proxies, and NetFlow, and investigate communication history to the management API and suspicious outbound traffic generated after compromise.

9. Attack Success Determination

Confirmed via Public Information

  • Malware Execution or Successful Authentication Confirmed: Public Info: Cisco has confirmed active exploitation of this vulnerability, and CISA has added it to the KEV catalog. However, commands executed and subsequent compromise scope per organization have not been published.

Organization-Specific Criteria

  • Attack Attempt Observed (Success Unconfirmed): Criteria: Reached the stage where suspicious API requests are observed. Receipt of requests alone does not confirm successful authentication bypass; correlate with response codes and management operation logs.
  • Initial Execution Confirmed: Criteria: Reached the stage where code execution with root privileges following authentication bypass is confirmed via appliance process start or command execution records.
  • Subsequent Compromise Confirmed: Criteria: Reached the stage where setting modifications, new account creation, external C2 traffic, and credential access are supported by individual evidence. Avoid concluding lack of compromise based solely on missing appliance-side logs; cross-reference with external logs.

10. Investigation Playbook

Trigger

  • Inference: Triggered by discovery of unpatched ISE nodes, warning notices from Cisco or CISA, or detection of suspicious requests in web access logs.

Initial Verification

  • Inference: Review software versions, network reachability, access.log, management operation history, and external firewall/NetFlow logs for all nodes.

Endpoints and Servers

  • Preserve forensic evidence on the appliance following Cisco TAC guidance, and investigate root process execution history, suspicious file placements, and log deletion traces.

Authentication and Cloud

  • Inference: Investigate registered administrator accounts, various certificates, API secrets, RADIUS shared secrets, and integrated IdP configurations; update credentials if information exposure is suspected.

Subsequent Actions

  • Inference: Track suspicious accounts created after compromise, network configuration changes, outbound external traffic, and impacts on internal authentication processing.

Containment

  • Restrict access to the management interface and apply the security patch. If compromise is strongly suspected, reimage the appliance with Cisco support and refresh all related secrets.

Decision Categories

  • Inference: Distinguish and assess stages including mere scanning, authentication bypass establishment, root command execution, and total compromise of the authentication control infrastructure. Ensure missing logs are not treated as proof of no compromise.

11. Defense and Detection Ideas

Single Event

  • Cisco advises checking access.log for suspicious usernames such as dummyuser.
  • Inference: Do not conclude immediately based on username alone; correlate with preceding HTTP requests and responses, management operation logs, and process execution records to narrow down investigation candidates.

Timeline Correlation

  • Inference: Analyze the chronological progression from suspicious requests to the management API through configuration changes, root-privilege process execution, and outbound external traffic.

Hunting

  • Inference: Inventory all internal ISE nodes to hunt for unpatched nodes, unexpected access paths, and discrepancies with external network logs.

Log Gaps

  • Because attackers may clear logs inside the appliance, preserving firewall logs, NetFlow, and SIEM logs forwarded and saved to external servers is essential.

Priority Countermeasures

  • Prioritize applying emergency patches to all nodes, implementing management access controls (iACLs), preserving external logs, and developing a rotation plan for administrative secrets.

12. Facts / Inference / Hypothesis

Facts

  • Cisco described CVE-2026-76460 as an authentication bypass vulnerability due to API authentication flaws and assigned a CVSS base score of 10.0.
  • Crafted HTTP requests may allow unauthenticated remote attackers to bypass web management authentication and execute commands with root privileges.
  • Vulnerable Cisco ISE and ISE-PIC releases are affected in all configurations, regardless of whether specific features are enabled or disabled. There are no workarounds for this vulnerability.
  • Fixed versions are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
  • Cisco confirmed active exploitation in the wild, and CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2026-09-16.
  • Cisco advised checking access.log for suspicious usernames and requested investigation of external network and firewall logs since attackers may clear their tracks.

Inference

  • If an attacker gains root privileges on ISE, the integrity of credentials, certificates, and network access control rules stored or handled by the affected system can no longer be assumed. Response planning should therefore consider rebuilding the affected ISE infrastructure and rotating related secrets, rather than treating the incident as a web server modification alone.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in Open Questions and Further Investigation.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: medium): Mapping applied when publicly exposed ISE management APIs are exploited. This vulnerability can also be exploited via internal network reachability, and management interfaces were not necessarily exposed to the internet in all confirmed exploitation cases.

14. Open Questions and Further Investigation

  • Identification of threat actors, targeted organizations, the exact date exploitation began, and specific HTTP requests and IOCs used in the attacks.
  • Commands executed after compromise, persistence mechanisms established, and the actual scope of stolen credentials.
  • Number of victim organizations and regional distribution known to Cisco.

15. Impact on SOCs and Organizations

Cisco ISE serves as the core infrastructure for internal network authentication and access control. Organizations must verify running versions and apply emergency patches to all nodes reachable from internal LANs or VPNs, regardless of whether management screens are externally exposed. Because attackers may erase appliance logs, suspected compromise calls for investigation using external network records as well as local evidence. In addition to applying patches, organizations should consider reimaging affected appliances with Cisco's guidance and rotating administrative secrets according to the investigation findings.

16. Summary by Role

  • SOC: Preserve ISE access.log, external firewall and NetFlow logs, management operation logs, and root command execution traces, cross-referencing under the assumption that log deletion may have occurred.
  • Administrators: Apply security patches to all ISE and ISE-PIC nodes, and temporarily restrict management access origins to trusted terminals and segments using iACLs.
  • Users: General user action is not required. Administrators must immediately report suspicious behavior on ISE appliances to the SOC.

Top comments (0)