Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass

What to do

1. Inventory every ISE and ISE-PIC node in every deployment and record its release and patch level.
2. Install 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 on all nodes; migrate ISE 3.0 to a supported release.
3. Until patched, use infrastructure ACLs so only required management and control-plane traffic can reach ISE nodes.
4. On every node, check the API gateway access log for suspicious usernames, starting with show logging application ise-kong/access.log | include dummyuser.
5. If you find signs of compromise, re-image the affected nodes, restore configuration from a known-good backup, and rotate ISE admin, RADIUS/TACACS+ shared secrets and integration credentials.

How to check if you are affected or compromised

• Run show logging application ise-kong/access.log | include dummyuser on every node; any output may indicate malicious activity.
• Collect a support bundle with debug logs and review older ./ise/logs/apigateway/access.log.*.gz files for suspicious usernames.
• Check firewall and network logs outside ISE for unexpected uploads from ISE nodes to external IPs or downloads from suspicious addresses.
• Review ISE admin accounts, authorization policies and network device definitions for changes nobody on your team made.

What happened#

On September 16, 2026, Cisco published CVE-2026-76460, an authentication bypass in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The cause is "insufficient authentication control on an API endpoint". An unauthenticated attacker who sends a crafted request to that endpoint gets into the device without going through the web-based management interface. Cisco scores it CVSS 3.1 10.0 (Critical) and says its PSIRT is aware of active exploitation. Cisco also warns that after a successful exploit, "threat actors may obtain command execution with root privileges" and may then remove or hide evidence.

CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, with a September 19 deadline for federal agencies. Its ransomware status is "Unknown", and CISA flags it for forensic triage. CISA's assessment in the CVE record rates exploitation automatable and the technical impact "total". Cisco found the bug while resolving a TAC support case and has not described the attacks.

Who is affected#

ISE and ISE-PIC are affected regardless of configuration. The first fixed releases are:

• 3.1: 3.1 Patch 12
• 3.2: 3.2 Patch 11
• 3.3: 3.3 Patch 12
• 3.4: 3.4 Patch 7
• 3.5: 3.5 Patch 4

ISE 3.0 has reached end of software maintenance, and Cisco tells those customers to migrate to a supported fixed release. Help Net Security notes that the same release fixed many other ISE flaws, and that 3.1 and 3.2 now receive only critical fixes. That makes 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 the better targets. There is no workaround.

Do you really need to act?#

If you run ISE, yes, today. Every precondition favors the attacker: no credentials, no user interaction, no special configuration, and a changed scope in the CVSS vector. ISE sits at the center of network access control, and a compromised ISE node can change who gets onto wired, wireless and VPN networks. It also holds RADIUS and TACACS+ shared secrets, network device credentials and directory integrations. Cisco's warning about root access and evidence removal means that patching alone does not prove you are clean.

ISE is usually deployed on internal networks, which narrows the field of attackers. It does not remove the risk, because Cisco documents no specific port or interface for the vulnerable API, and an attacker with any internal foothold can reach it. Cisco's only interim mitigation is infrastructure ACLs that allow just the management and control-plane traffic each node needs. Bitsight also stresses that this does not replace patching. If you do not run ISE, nothing here applies to you, though it is worth asking managed network providers whether they do.

What to do now#

1. List every ISE and ISE-PIC node, including secondary admin, monitoring and policy service nodes in distributed deployments. Check the release and installed patch with show version on each node.
2. Install the fixed patch for your train on all nodes, or migrate 3.0 deployments to a supported release.
3. Until every node is patched, apply infrastructure ACLs so only the management stations and network devices that need ISE can reach it.
4. Run the indicator check on every node, not just the primary: show logging application ise-kong/access.log | include dummyuser.
5. If anything looks suspicious, follow Cisco's advice: re-image the affected nodes and restore configuration from backup. Then rotate the ISE admin passwords, RADIUS/TACACS+ shared secrets and the service accounts ISE uses for Active Directory and other integrations.

How to tell if you were hit#

Cisco's indicator lives in the API gateway (Kong) access log. Look for suspicious usernames, with dummyuser as a non-exhaustive example, and treat any matching entry as possible malicious activity. The live log only covers recent traffic. For older entries, collect a support bundle with debug logs included and shared-key encryption, decrypt it, and search ./ise/logs/apigateway/access.log.*.gz. Because an attacker with root can wipe local logs, Cisco recommends checking telemetry outside the device as well: firewall and network logs showing unexpected uploads from ISE nodes to external IPs, or downloads from malicious addresses. Also review admin accounts, authorization policies and network device entries for changes you cannot explain.

Timeline#

• Sep 16, 2026 — Cisco publishes the advisory and fixed patches, citing active exploitation. CISA adds CVE-2026-76460 to KEV.
• Sep 17, 2026 — CISA's exploitation assessment is added to the CVE record, and press and vendor write-ups follow.
• Sep 19, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-76460 · KEV 2026-09-16 · A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Cisco — Cisco Identity Services Engine Authentication Bypass Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5) sec.cloudapps.cisco.com
2. CVE record — CVE-2026-76460 cve.org
3. NVD — CVE-2026-76460 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-76460 cisa.gov
5. Bitsight — CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation bitsight.com

Coverage and analysis

1. Help Net Security — Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460) helpnetsecurity.com