Cisco ISE Patch Tuesday in September 2026: What the Five Critical Advisories Actually Change

Vulnerability overview

On 16 September 2026 Cisco released a coordinated set of advisories for Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Five of the addressed issues are rated critical. The headline item is CVE-2026-76423, an authentication bypass in the ISE REST API with a CVSS v3 score of 10.0.
The rest of the set matters because remediation is not a single patch. CVE-2026-20130 is a hardening-release finding for improper neutralization, also scored 10.0. CVE-2026-20307 is an insecure deserialization flaw that leads to remote code execution at 9.9. CVE-2026-20305 is command injection in the diagnostic tools at 9.1. CVE-2026-20284 is SQL injection in the SXP REST API at 9.1. Cisco states it has not observed malicious exploitation of these specific CVEs.

Mechanism and exploitation conditions

The five flaws are not variations on one bug. They sit in different components and require different attacker positions, which is why they need to be understood separately.
CVE-2026-76423 is an authorization failure. The REST API web service is reachable with insufficient authorization checks, so an unauthenticated remote attacker can act with administrative rights. No credential is needed; reachability is the whole precondition.
CVE-2026-20307 is a deserialization flaw. An attacker sends serialized Java objects to the web interface, and the server processes them without adequate validation. Deserialization bugs of this shape typically end in code execution in the context of the application server.
CVE-2026-20305 is command injection in diagnostic tooling. Cisco's advisory describes an authenticated, remote attacker using the diagnostic tools to inject commands on the underlying operating system and elevate to root. This one needs a foothold first, but it converts a low-privilege position into full control.
CVE-2026-20284 is SQL injection in the SXP REST API, which affects the integrity of data the API queries and returns.
CVE-2026-20130 comes from Cisco's own hardening review and covers improper neutralization of input.
The common thread is that ISE exposes several distinct interfaces - the REST API, the web management interface, diagnostic endpoints and the SXP service - and each has its own validation responsibility. A defect in any one of them undermines the policy decisions the appliance makes for the rest of the network.

Impact

ISE decides which users, devices and guests may join the network and what they may reach afterwards. That makes it a control plane rather than an endpoint. An attacker who gains administrative access through CVE-2026-76423 can read and modify identity records, change authorization policy, and alter how network devices enforce access. They can also use the appliance's trusted relationships with switches and wireless controllers as a pivot.
The deserialization and command injection flaws extend the damage differently. Once code runs on the appliance, the attacker is no longer limited to what the API exposes; they can reach the underlying operating system, inspect configuration and credentials, and establish persistence.
Cisco also notes that some issues in this cycle can produce denial-of-service conditions that block unauthenticated endpoints from reaching business networks. For an organisation that uses ISE for network admission, that is an availability risk on top of the confidentiality and integrity risks.

Affected products and scope

The affected software is Cisco Identity Services Engine and Cisco ISE Passive Identity Connector. Cisco lists releases 3.1, 3.2, 3.3, 3.4 and 3.5 as impacted, with several issues affecting ISE-PIC across all device configurations.
Fixed builds are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Deployments on older, unsupported branches have no fixed build for their branch and should plan migration.
Cisco attributes the discovery of these issues to internal security testing using existing processes as well as frontier AI models. That describes the finding process; it does not indicate exploitation.

Exposure context

A ZoomEye search for app="Cisco Identity Services Engine" returns 883,616 assets matching that product fingerprint. This is a deployment-population figure. It says nothing about which of those assets run a vulnerable release, and nothing about whether their management interfaces are reachable from an untrusted network. It does tell you the population that a patch programme has to cover.
A CVE-indexed ZoomEye query for vul.cve="CVE-2026-76423" returned zero results at the time of writing, which is normal for a newly published CVE that has not yet been indexed against assets. Zero CVE-indexed results are not evidence that no vulnerable systems exist.

Remediation and mitigations

Apply the fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4. Because the set spans several components, verify the patch level on every node rather than assuming one upgrade covers the estate.
Cisco describes no complete workaround. The practical compensating control is network restriction: use infrastructure access control lists so that only trusted internal subnets can reach ISE management interfaces, and confirm that neither the REST API nor the diagnostic tools are exposed to user networks or to the internet.
For detection, review administrative audit logs and API access logs for requests that do not map to a known account or automation job. Look for configuration changes outside change windows, new or modified policy sets, and unexpected use of diagnostic functions. Where logs may have been altered, cross-check against external network and firewall logs.
Finally, re-test after patching. Send an unauthenticated request to the REST API and confirm it is rejected, rather than relying on the version string alone.

References

• Cisco Security Advisory, Cisco Identity Services Engine REST API authentication bypass (cisco-sa-ISE-ABP-VNSW7Tn5), referenced via CISA KEV notes for CVE-2026-76423.
• CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-76423, added 16 September 2026.
• SecurityOnline.info, "Cisco Patches Critical Cisco ISE Vulnerabilities", 17 September 2026, https://securityonline.info/cisco-ise-vulnerabilities-2/
• NVD entries for CVE-2026-76423, CVE-2026-20130, CVE-2026-20307, CVE-2026-20305 and CVE-2026-20284.