DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-76460: CVE-2026-76460: Cisco Identity Services Engine Authentication Bypass Vulnerability

#security #cve #cybersecurity

CVE-2026-76460: Cisco Identity Services Engine Authentication Bypass Vulnerability

Vulnerability ID: CVE-2026-76460
CVSS Score: 10.0
Published: 2026-09-16

On September 16, 2026, Cisco disclosed a critical authentication bypass vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This vulnerability allows unauthenticated, remote attackers to bypass the administrative interface controls and execute privileged API requests. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to the Known Exploited Vulnerabilities (KEV) Catalog with an immediate remediation deadline.

TL;DR

A critical vulnerability in Cisco ISE (CVSS 10.0) allows remote, unauthenticated attackers to bypass authentication and gain full administrative control via crafted API requests.

⚠️ Exploit Status: ACTIVE

Technical Details

  • CWE ID: CWE-648
  • Attack Vector: Network
  • CVSS Severity: 10.0 (Critical)
  • EPSS Score: 0.14026
  • Exploit Status: Active Exploitation in the Wild
  • CISA KEV Status: Listed

Affected Systems

  • Cisco Identity Services Engine (ISE) Software
  • Cisco ISE Passive Identity Connector (ISE-PIC)
  • Cisco Identity Services Engine (ISE) Software: 3.1.0 <= Patch 11 (Fixed in: 3.1.0 Patch 12)
  • Cisco Identity Services Engine (ISE) Software: 3.2.0 <= Patch 10 (Fixed in: 3.2.0 Patch 11)
  • Cisco Identity Services Engine (ISE) Software: 3.3.0 <= Patch 11 (Fixed in: 3.3.0 Patch 12)
  • Cisco Identity Services Engine (ISE) Software: 3.4.0 <= Patch 6 (Fixed in: 3.4.0 Patch 7)
  • Cisco Identity Services Engine (ISE) Software: 3.5.0 <= Patch 3 (Fixed in: 3.5.0 Patch 4)

Exploit Details

  • GitHub: Educational mock laboratory setup representing the CVE-2026-76460 routing logical flaw.

Mitigation Strategies

  • Install official Cisco software patches immediately.
  • Restrict administrative access to Cisco ISE management interfaces to specific trusted administrative subnets.
  • Implement persistent log monitoring for unauthenticated access patterns on administrative API paths.

Remediation Steps:

  1. Locate all Cisco ISE and Cisco ISE-PIC deployments across the network.
  2. Verify the current software version and patch level of each node.
  3. Acquire the appropriate software update patch from the Cisco Software Center.
  4. Apply the patch during a scheduled maintenance window.
  5. Review system logs post-remediation to confirm that unauthenticated API requests are rejected with a 401 Unauthorized response status.

References

Read the full report for CVE-2026-76460 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)