When the Access Controller Is the Target: Reading Cisco ISE CVE-2026-76460

Cisco Identity Services Engine decides who and what may join an enterprise network. On September 16, 2026, Cisco published a fix for CVE-2026-76460, an authentication bypass in an ISE API endpoint that carries a CVSS score of 10.0. CISA added it to the Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until September 19 to act. Cisco's Product Security Incident Response Team confirmed exploitation in the wild, and the company found the flaw while handling a TAC support case.
The technical cause is narrow. An API endpoint behind the web management interface did not enforce authentication properly, classified as CWE-648, incorrect use of privileged APIs. An unauthenticated remote attacker can send a crafted request to that endpoint and bypass the login page entirely. Successful exploitation yields command execution with root privileges on the ISE node.

Why an access control platform is a different kind of target

Most vulnerabilities expose a service. This one exposes the logic that decides who gets access. ISE holds the access criteria for the network and the management credentials for the devices it governs. An attacker who controls the management plane can rewrite policy, issue access decisions for fabricated identities, and use stored credentials to reach downstream systems.
The downstream reach is what makes the blast radius hard to bound. ISE integrates with Active Directory and holds machine accounts, shared secrets, and device management credentials. The loss is not limited to one appliance; it extends to everything that trusts ISE's decisions.
There is no configuration-level escape. Cisco states that the vulnerability affects ISE and ISE-PIC in all configurations and that no workaround exists. The only durable fix is the patch. The only temporary measure is an infrastructure access control list that limits which systems can reach the management and control interfaces.

Affected versions and fixes

Cisco lists fixes by maintenance branch rather than main version, which matters for asset inventories that only record the major release:

• ISE 3.1: Patch 12
• ISE 3.2: Patch 11
• ISE 3.3: Patch 12
• ISE 3.4: Patch 7
• ISE 3.5: Patch 4 ISE 3.0 is affected and has reached end of software maintenance. Organizations still running 3.0 must migrate to a supported branch before they can patch. This is the same release batch in which Cisco published 77 CVEs, 41 of them affecting ISE, so the upgrade should be planned as a batch rather than a single patch.

Detection when the attacker holds root

Cisco recommends checking access.log on every node for suspicious usernames. A distributed ISE deployment has multiple nodes, and an attacker can target any reachable one, so a single-node check is not sufficient. The example command Cisco provides is:

show logging application ise-kong/access.log | include dummyuser

Any output from that search may indicate malicious activity.
The harder problem is that root access lets an attacker delete or alter local logs. Evidence on the compromised node may be incomplete or absent. Detection therefore has to lean on sources outside the device: firewall and network logs that show unexpected uploads, downloads, or outbound connections from the ISE node to unfamiliar addresses. If those logs show traffic the node should not generate, treat the node as compromised.
Cisco's guidance for a suspected compromise is to reimage the affected node and restore configuration from a known-good backup, rather than attempting to clean it in place. That is a heavy step, and it follows from the privilege level involved: a root-level intruder can install persistence, alter configuration, and remove traces, so in-place cleanup cannot establish trust.

What to do in order

1. Inventory every ISE and ISE-PIC node and record the patch level, not just the major version.
2. Upgrade to the branch-specific fix. Plan the 3.0 migration separately.
3. Where patching cannot happen immediately, apply infrastructure ACLs so only trusted systems reach the management and control interfaces.
4. Search access.log on every node for suspicious usernames and unexpected API activity.
5. Cross-check firewall, proxy, and network logs for anomalous traffic originating from ISE nodes.
6. If compromise is suspected, reimage and restore from backup, then rotate credentials and secrets that the node held. The pattern here is not new, but the target is. Identity and access control platforms sit at the root of the trust chain, and a bypass in one of them means every downstream authorization decision may be operating on falsified input while appearing to work normally.

References

• Cisco Security Advisory for CVE-2026-76460, Cisco Identity Services Engine authentication bypass, published September 16, 2026.
• CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-76460, added September 16, 2026, federal remediation deadline September 19, 2026.
• NVD record for CVE-2026-76460, CVSS 10.0, CWE-648.