TL;DR
- what: Cisco disclosed CVE-2026-76460, a CVSS 10.0 authentication bypass on an Identity Services Engine API endpoint that is already under active exploitation.
Cisco confirmed on September 17, 2026 that attackers are actively exploiting CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine. A single crafted request to an affected API endpoint gets an unauthenticated remote attacker past the web based management interface, and Cisco states that successful exploitation can yield command execution with root privileges. CISA added the CVE to the Known Exploited Vulnerabilities catalog on September 16 and set the federal civilian remediation deadline at September 19, a three day window that tells you how the agency reads the risk.
Why root on ISE is worse than root on most boxes
ISE is not an edge appliance you can shrug off. It is the policy decision point for 802.1X, MAB, guest onboarding, posture assessment, and TACACS+ device administration. An attacker with root on it can author authorization policy, issue themselves network access that every switch and wireless controller in the estate will honor, read RADIUS shared secrets and certificate material, and reach the Active Directory integration account ISE uses for identity lookups. Compromise of the authentication authority converts into quiet, credentialed access everywhere downstream, and it looks like normal policy from the switch side.
The root cause is insufficient authentication control on an API endpoint. Cisco says the flaw affects Cisco ISE and Cisco ISE Passive Identity Connector regardless of device configuration, so there is no hardened build, no feature toggle, and no deployment model that escapes it. Cisco has not described the attacks or named an actor.
⚠️ No workaround exists — Cisco is explicit that there is no workaround. The only stopgap is an infrastructure ACL that permits management and control plane traffic to the appliance from required sources only. That shrinks who can reach the endpoint, it does not close the hole. Patching is the fix.
Fixed releases
- ISE 3.1: fixed in 3.1 Patch 12
- ISE 3.2: fixed in 3.2 Patch 11
- ISE 3.3: fixed in 3.3 Patch 12
- ISE 3.4: fixed in 3.4 Patch 7
- ISE 3.5: fixed in 3.5 Patch 4
Patch every node in a distributed deployment, not just the primary admin node. Policy Service Nodes and Monitoring nodes run the same code and expose the same interface. A partially patched cube leaves the attacker an unpatched entry point that still speaks to the rest of the deployment as a trusted peer.
Hunt before you patch, not after
Because exploitation ends at root, Cisco warns that evidence of exploitation and indicators of compromise may be removed or hidden by the threat actor. Patching an already compromised node upgrades the software and leaves the intruder in place. Run the compromise check first, on every node, and capture the output somewhere off the appliance. Cisco's published indicator is suspicious usernames in the Kong API gateway access log.
show logging application ise-kong/access.log | include dummyuser
show logging application ise-kong/access.log | include admin
show version
Cisco's guidance is direct: the presence of any entry in that first command's output likely points to malicious activity. Do not treat a clean result on the primary admin node as a clean deployment. Repeat the check node by node, and pull the raw access.log to a collector so the evidence survives anything the attacker does next.
⚠️ A hit means re-image, not remediate — If you find unexpected usernames, Cisco's instruction is to re-image the affected nodes and restore from configuration backup if needed. Treat every credential and secret stored on that node as disclosed: RADIUS shared secrets, TACACS keys, the AD join account, admin passwords, and any certificate private keys held on the appliance.
This was not a single advisory
CVE-2026-76460 landed inside a bundle of 77 new CVEs published the same Wednesday. Of those, 41 affect ISE and 28 affect the Secure Firewall portfolio. Cisco describes part of the set as hardening measures from an ongoing internal review, which is the vendor telling you the product line is under sustained scrutiny and more is coming. The items worth pulling out of the pile:
- CVE-2026-76423 (CVSS 10.0) plus CVE-2026-76424 through CVE-2026-76428: REST API authentication bypass, remote code execution, SQL injection, and XML External Entity injection in ISE and ISE-PIC.
- CVE-2026-20130 and CVE-2026-20192, both CVSS 10.0, alongside CVE-2026-20234 and CVE-2026-20237 at 9.9: command injection, authentication or authorization bypass, and information disclosure in ISE and ISE-PIC.
- CVE-2026-20176 (9.9), CVE-2026-20305 and CVE-2026-20306 (9.1): authenticated arbitrary command execution as root on ISE, exploitable by anyone holding valid administrative credentials, which is exactly what CVE-2026-76460 gives an attacker.
- CVE-2026-20322, CVE-2026-20325 (both 9.9) and CVE-2026-20326 (9.8): command injection and auth bypass in Cisco Nexus Dashboard.
- CVE-2026-76412, CVE-2026-76413 and CVE-2026-76420 (9.0): root access and session forgery in Secure Firewall Management Center, plus a grouped set of ASA, FTD and FMC issues from CVE-2026-20329 to CVE-2026-20336.
- CVE-2026-76461 (9.8): AsyncOS for Cisco Secure Email Gateway, confirmed under active exploitation days earlier.
The chaining risk is the part to brief upward. CVE-2026-76460 hands over administrative access without credentials. Several of the authenticated command injection bugs in the same release then convert that access into root code execution through a supported path that generates ordinary looking admin activity. Patching the zero-day alone while deferring the authenticated RCE fixes to the next maintenance window leaves the second half of the chain intact.
The next 48 hours
- Inventory every ISE and ISE-PIC node, including lab, DR, and the Passive Identity Connectors people forget they deployed. Record the exact patch level per node.
- Run the access.log check on all nodes and export the results off box before touching anything else.
- Apply the fixed patch for your train. If a maintenance window is genuinely impossible today, put an iACL in front of the management interface now and treat it as temporary containment.
- Forward ise-kong access logs and ISE administrative audit events to the SIEM if they are not already there. You cannot alert on a log that never leaves the appliance.
- Plan credential rotation for anything stored on ISE. If you find an indicator, rotation is not optional and re-image comes first.
The honest limit on detection here: an attacker with root can edit or delete the very log Cisco points you at, so an empty result proves less than it appears to. Weigh it alongside network telemetry, upstream firewall logs of who reached the admin interface, and any unexplained authorization policy changes. Patch on the assumption you are late.
Originally published on RedEye Threat Intelligence.
Top comments (0)