Cisco has disclosed a maximum-severity vulnerability in Cisco Identity Services Engine (ISE) that is being actively exploited in the wild.
Tracked as CVE-2026-76460, the vulnerability allows an unauthenticated remote attacker to bypass authentication through an affected Cisco ISE API endpoint. Cisco has assigned the flaw a CVSS score of 10.0, the highest possible severity rating.
Cisco has confirmed that successful exploitation may provide attackers with command execution as root on the affected appliance. This level of access could allow threat actors to compromise the integrity of Cisco ISE itself, modify security configurations, access sensitive information, and remove evidence of their activity.
Cisco Product Security Incident Response Team (PSIRT) has confirmed active exploitation, while the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) Catalog on September 16, 2026.
Vulnerability Overview
| Attribute | Details |
| CVE | CVE-2026-76460 |
| Vendor | Cisco |
| Affected Products | Cisco Identity Services Engine (ISE), Cisco ISE Passive Identity Connector (ISE-PIC) |
| Severity | Critical |
| CVSS v3.1 | 10.0 |
| CWE | CWE-648 – Incorrect Use of Privileged APIs |
| Attack Vector | Network |
| Authentication Required | No |
| User Interaction | No |
| Active Exploitation | Yes |
| CISA KEV | Yes |
| Workaround | None |
| Vendor Advisory Date | September 16, 2026 |
The CVSS vector assigned by Cisco is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
This indicates that exploitation can occur remotely over the network, requires low attack complexity, requires no existing privileges, and does not require user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
What Is CVE-2026-76460?
CVE-2026-76460 is an authentication bypass vulnerability affecting an API in Cisco Identity Services Engine.
According to Cisco, the vulnerability exists because of insufficient authentication controls on an API endpoint.
An unauthenticated attacker can send a specially crafted request to the vulnerable endpoint and bypass the authentication protections of the web-based management interface. Successful exploitation provides unauthorized access to the affected appliance.
Cisco has not publicly disclosed the precise vulnerable endpoint or the request structure used in real-world attacks, which limits defenders’ ability to create highly specific network signatures.
However, the consequences of exploitation are severe.
Cisco explicitly warns that threat actors who successfully exploit CVE-2026-76460 may obtain command execution with root privileges.
That distinction is important. This is not simply a vulnerability that exposes a restricted administrative page. Root-level execution potentially places the underlying ISE appliance under the attacker’s control.
Why Cisco ISE Is a High-Value Target
Cisco ISE is commonly deployed as a centralized identity and network access control platform.
Organizations use ISE to determine which users and devices can connect to corporate networks and what resources those identities are permitted to access. It can participate in authentication, authorization, endpoint profiling, posture assessment, and enforcement of network access policies.
Compromise of this infrastructure therefore creates risks extending beyond the appliance itself.
An attacker controlling an ISE system could potentially use that position to interfere with access-control decisions, manipulate administrative configurations, access information held by the platform, or establish a stronger foothold inside the environment.
The security implications become particularly significant because Cisco states that exploitation may result in root command execution.
Active Exploitation Confirmed
Cisco PSIRT has confirmed that CVE-2026-76460 is being actively exploited in the wild and strongly recommends that customers upgrade immediately.
The vulnerability was reportedly discovered while Cisco was resolving a Technical Assistance Center (TAC) support case, suggesting that evidence associated with real-world activity contributed to its identification. Cisco has not publicly attributed the exploitation to a specific threat actor or campaign.
CISA also added CVE-2026-76460 to its Known Exploited Vulnerabilities Catalog on September 16.
For U.S. Federal Civilian Executive Branch agencies, the remediation deadline was September 19, 2026, only three days after the vulnerability was added to KEV.
As of publication, publicly available reporting does not establish the identity of the threat actor responsible for the observed exploitation or disclose a complete exploitation chain.
Evidence May Be Removed After Compromise
One of the most important aspects of Cisco’s advisory is its warning regarding forensic visibility.
Because exploitation may provide root-level command execution, an attacker could modify or delete logs and other evidence stored locally on the Cisco ISE system.
Cisco states:
Threat actors may remove or hide evidence of exploitation because of the level of access obtained.
For defenders, this means that a clean ISE appliance log cannot by itself rule out compromise.
Cisco specifically recommends correlating evidence from systems outside the potentially compromised appliance, including firewall and network telemetry. Investigators should look for suspicious activity such as unexpected data transfers initiated by the ISE node, connections to unusual external IP addresses, or downloads originating from potentially malicious infrastructure.
Indicators of Compromise and Detection Opportunities
Cisco has published limited but important detection guidance.
Administrators should examine the ISE API gateway access.log for unexpected or suspicious usernames. In distributed deployments, this investigation must be performed across every node.
Cisco provides the following example:
show logging application ise-kong/access.log | include dummyuser
The value dummyuser is a non-exhaustive example rather than a universal exploitation indicator. Defenders should investigate usernames that do not correspond with legitimate administrators or expected API activity.
Additional API gateway logs can be obtained by creating a support bundle with Include Debug Logs enabled and using shared-key encryption. After decrypting the bundle, relevant logs can be found under:
./ise/logs/apigateway/access.log.<date>.gz
Cisco states that suspicious entries may indicate malicious activity and recommends performing this analysis on every node in the deployment.
OP Innovate recommends expanding this investigation beyond the vendor-provided username check.
Security teams should correlate ISE activity against centralized network and security telemetry for:
- Management or API requests originating outside authorized administration networks.
- Unrecognized usernames appearing in ISE API gateway logs.
- Administrative activity without corresponding approved administrator sessions or change requests.
- Unexpected configuration or policy changes.
- Unusual outbound connections originating from ISE appliances.
- Unexpected uploads from an ISE node to an external address.
- Downloads from suspicious or previously unseen external infrastructure.
- Significant changes in network-access policies, administrative accounts, or connected identity sources.
- Evidence gaps or sudden interruptions in logging that could indicate deliberate log tampering.
Where possible, ISE logs should be forwarded to an external SIEM or logging platform so that forensic evidence remains available even if the appliance itself is compromised.
Affected Versions and Patches
Cisco states that the vulnerability affects Cisco ISE and Cisco ISE-PIC regardless of device configuration.
Cisco has released the following fixed versions:
| Cisco ISE / ISE-PIC Release | First Fixed Release |
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
Cisco ISE 3.0 has reached End of Software Maintenance. Customers operating that branch should migrate to a supported release containing the security fix.
No Workaround Is Available
Cisco has confirmed that there is no workaround that completely addresses CVE-2026-76460.
As an interim mitigation, Cisco recommends using infrastructure access control lists (iACLs) to permit only necessary management and control-plane traffic to reach affected ISE systems.
This can reduce the number of systems capable of reaching the vulnerable management surface, but it does not eliminate the underlying vulnerability.
Applying the fixed software remains the required remediation.
Organizations should ensure that ISE administrative interfaces and APIs are not broadly reachable and restrict access to designated administrative networks, management systems, or jump hosts wherever operationally possible.
Incident Response Guidance
Organizations that identify suspicious activity should not assume that installing the patch is sufficient to restore trust in the system.
Cisco strongly recommends re-imaging affected nodes and restoring them from a configuration backup if malicious activity is suspected.
This recommendation is particularly important because root access can allow an attacker to modify the underlying system and remove evidence.
Organizations investigating possible exploitation should preserve external logs and telemetry before remediation, examine every node in distributed ISE deployments, review changes to administrative accounts and access-control policies, inspect unusual network activity involving the ISE infrastructure, and determine whether credentials or other sensitive information accessible from the appliance should be rotated.
A compromised network access control platform should be treated as a high-impact infrastructure security incident rather than as a routine vulnerable-server patching event.
Previous Targeting of Cisco ISE
The current exploitation also follows previous attacks against Cisco ISE.
In 2025, attackers exploited CVE-2025-20337, another critical Cisco ISE vulnerability, in zero-day attacks. Amazon Threat Intelligence later disclosed that the attackers used the vulnerability to obtain pre-authentication remote code execution and deploy a custom in-memory web shell known as IdentityAuditAction, which masqueraded as a legitimate Cisco ISE component.
There is currently no public evidence connecting that campaign to exploitation of CVE-2026-76460.
The earlier activity is nevertheless significant because it demonstrates established attacker interest in compromising Cisco ISE infrastructure and highlights the strategic value of identity and network access-control systems.
Stay Safe. Stay Secure.
OP Innovate Research Team
