CVE-2026-76423: The Cisco ISE REST API Flaw That Hands Out Admin Without a Password
Vulnerability overview
Cisco published a set of security advisories on 16 September 2026 covering its Identity Services Engine (ISE) product line. The most severe item is CVE-2026-76423, an authentication bypass in the ISE REST API that carries a CVSS v3 base score of 10.0. Cisco's advisory states the root cause plainly: the REST API web service was exposed with insufficient authorization checks. An unauthenticated, remote attacker who can reach that interface can obtain administrative access to the appliance.
CVE-2026-76423 is not an isolated defect. Cisco shipped it alongside related issues in the same release cycle, including CVE-2026-20130 (a hardening-release improper neutralization finding also scored 10.0), CVE-2026-20307 (insecure deserialization leading to remote code execution, 9.9), CVE-2026-20305 (command injection in diagnostic tooling, 9.1), and CVE-2026-20284 (SQL injection in the SXP REST API, 9.1). Cisco has stated it is not aware of malicious exploitation of these specific CVEs at the time of disclosure.
Mechanism and exploitation conditions
ISE is the policy decision point for network access control. Its REST API is the programmatic surface that administrators, automation tooling and integrations use to read and modify identity data, policy sets and endpoint posture. The API is meant to require authentication and to enforce role-based authorization on every privileged operation.
In CVE-2026-76423, that authorization layer is missing on the exposed web service. The practical consequence is that an HTTP request crafted to reach the affected endpoint is processed without the caller proving an identity or holding the required role. Cisco's wording attributes the flaw to insufficient authorization checks rather than to a credential-handling bug, which means the bypass does not depend on guessing or stealing a password. It depends only on network reachability of the API.
Exploitation conditions are therefore narrow but not trivial to satisfy in a well-run environment:
- The attacker needs IP-level access to the ISE REST API. In most deployments that interface is on a management network, not the public internet.
- No authentication and no user interaction are required once that access exists.
- The attacker does not need a valid account, a session token or a client certificate. Where the management plane is reachable - flat internal networks, misconfigured firewall rules, VPNs that grant broad internal access, or appliances accidentally exposed to the internet - the precondition is met.
Impact
Administrative access to ISE is a high-value outcome because ISE sits at the centre of the trust boundary. An attacker who reaches the administrative API can:
- Read and alter identity data, including user and endpoint records.
- Change authorization policy, for example by moving endpoints into permissive policy sets or disabling posture requirements.
- Modify network device integrations, which can affect how switches and wireless controllers enforce access.
- Use the appliance as a pivot point into the corporate network, since ISE maintains trust relationships with network infrastructure. Because ISE is a centralised control plane, a compromise is not contained to one host. It degrades the mechanism the organisation relies on to decide who and what may connect. Cisco also notes that some flaws in this release cycle can produce denial-of-service conditions that block unauthenticated endpoints from reaching business networks, which is a separate but related availability risk.
Affected products and scope
According to Cisco, the affected software is Cisco Identity Services Engine and Cisco ISE Passive Identity Connector. The advisories list releases 3.1, 3.2, 3.3, 3.4 and 3.5 as impacted, and several of the issues apply to ISE-PIC across all device configurations.
Cisco has published fixed builds: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Organisations running releases older than the supported branches should treat migration to a supported release as part of the remediation, not as a separate project.
One detail worth noting from the disclosure: Cisco says these vulnerabilities were found during internal security testing using existing processes as well as frontier AI models. That is a statement about how the findings were produced, not a statement about exploitation in the wild.
Exposure context
A ZoomEye query for the product fingerprint app="Cisco Identity Services Engine" returns 883,616 matching assets. This figure describes assets that match the product fingerprint. It does not prove that any of those assets run a vulnerable release, and it does not prove that their REST APIs are reachable by an attacker. It is a measure of how widely the product is deployed and therefore how large the remediation surface is.
A separate CVE-indexed query, vul.cve="CVE-2026-76423", returned zero results at the time of writing, which is expected for a freshly published CVE that ZoomEye has not yet indexed against assets. The absence of CVE-indexed results should not be read as an absence of affected deployments.
Remediation and mitigations
- Patch. Apply the fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4. This is the only complete fix.
- Restrict management access. There are no full workarounds, but Cisco's guidance is to apply infrastructure access control lists so that only trusted internal subnets can reach ISE management interfaces. Do not leave the REST API reachable from user VLANs or from the internet.
- Review exposure. Treat any internet-facing ISE management interface as an emergency. Check firewall rules and NAT entries for the appliance.
- Hunt for signs of abuse. Review ISE administrative audit logs and API access logs for requests that do not correspond to a known account or automation job, and for configuration changes made outside change windows.
- Validate after patching. Confirm the running version and patch level on every node, including ISE-PIC instances, and re-test that the REST API rejects unauthenticated requests.
References
- Cisco Security Advisory, Cisco Identity Services Engine REST API authentication bypass (cisco-sa-ISE-ABP-VNSW7Tn5), referenced via CISA KEV notes for CVE-2026-76423.
- CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-76423, added 16 September 2026.
- SecurityOnline.info, "Cisco Patches Critical Cisco ISE Vulnerabilities", 17 September 2026, https://securityonline.info/cisco-ise-vulnerabilities-2/
- NVD entry for CVE-2026-76423.
Top comments (0)