DEV Community

kozhevniko
kozhevniko

Posted on

Cisco ISE CVE-2026-76460: a small fingerprint with a large consequence

#zoomeye #exposuremanagement #networkaccesscontrol

Cisco ISE CVE-2026-76460: a small fingerprint with a large consequence

Not every exposure is measured in millions. Cisco Identity Services Engine is a network access control platform, and its population is orders of magnitude smaller than the web servers and routers in the same index. That smaller number carries more risk per host, because an ISE appliance is where network admission decisions happen.

Query and scope

ZoomEye returns 4,059 results for the query below, captured on 11 October 2026 through the ZoomEye API:
app="Cisco ISE"
The unit is hosts and the scope is all indexed assets matching the Cisco ISE fingerprint. A four-digit count is a tractable list. For an exposure assessment, a short list of high-value identity systems is often more actionable than a long list of commodity servers, because each entry is either a system you own or a system you should investigate.

Why this count differs from a commodity one

CVE-2026-76460 is an authentication bypass on an API endpoint, classified as CWE-648 and scored CVSS 10.0. Cisco states it affects ISE and ISE Passive Identity Connector regardless of device configuration, and that successful exploitation grants root command execution on the appliance. There is no workaround. Fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4, with ISE 3.0 past end of maintenance.
The CVSS scope metric is set to changed, which reflects that the impact crosses out of the appliance. An ISE node decides which device joins which segment. Root on that node is authority over the admission decision itself, and the identities, policies and logs the node holds.

Reading a four-digit result set carefully

A small result set invites treating the whole list as a target list, which is the wrong use. The right use is comparison against your own inventory. If your organisation runs ISE, the appliance should appear in your asset records, and the search tells you whether it also appears from outside. An ISE deployment that surfaces in an internet-wide search is a planning problem, because the management interface was not meant to be reachable that way.
The catalog timeline confirms the risk. Cisco disclosed the issue on 16 September 2026, stating it was found during a support case with exploitation observed in the field, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 19 September 2026 deadline.

From count to action

Inventory every ISE node and confirm the patch level. Where patching cannot happen immediately, restrict management and control-plane traffic to known administrative networks with ingress access control lists, accepting that this is containment rather than a fix. Because root access allows an attacker to alter or remove local evidence, Cisco advises re-imaging affected nodes and restoring configuration from a verified backup. Review the API gateway log on each node for request lines containing unexpected usernames, and collect API gateway logs through support bundles.

References

Top comments (0)