---
title: "Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass"
url: https://erroneo.us/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/
description: "Unauthenticated API flaw in Cisco ISE and ISE-PIC is exploited and can lead to root. Fixed in 3.3 P12, 3.4 P7, 3.5 P4 and others. Patch now and check logs."
type: security-brief
section: "Security Digest"
date_published: 2026-09-16
date_modified: 2026-09-16
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-76460"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco ISE CVE-2026-76460: Exploited CVSS 10 Auth Bypass

**Verdict: Act now.** If you run Cisco ISE or ISE-PIC on any release before the fixed patches, patch now and hunt every node; the bug needs no login, is exploited, and Cisco warns attackers may get root and erase their tracks.

- **Who must act:** Every organization running Cisco Identity Services Engine or ISE Passive Identity Connector 3.0 through 3.5 for network access control, RADIUS/TACACS+ or identity services, in any deployment size.
- **Who can relax:** Organizations that do not run Cisco ISE or ISE-PIC; other Cisco products are not named in this advisory.
- **Affected:** Cisco ISE / ISE-PIC 3.1 before 3.1 Patch 12; Cisco ISE / ISE-PIC 3.2 before 3.2 Patch 11; Cisco ISE / ISE-PIC 3.3 before 3.3 Patch 12; Cisco ISE / ISE-PIC 3.4 before 3.4 Patch 7; Cisco ISE / ISE-PIC 3.5 before 3.5 Patch 4; Cisco ISE 3.0 (end of software maintenance; migrate)
- **Fixed:** ISE 3.1 Patch 12; ISE 3.2 Patch 11; ISE 3.3 Patch 12; ISE 3.4 Patch 7; ISE 3.5 Patch 4
- **CVEs:** CVE-2026-76460
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every ISE and ISE-PIC node in every deployment and record its release and patch level.
2. Install 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 on all nodes; migrate ISE 3.0 to a supported release.
3. Until patched, use infrastructure ACLs so only required management and control-plane traffic can reach ISE nodes.
4. On every node, check the API gateway access log for suspicious usernames, starting with show logging application ise-kong/access.log | include dummyuser.
5. If you find signs of compromise, re-image the affected nodes, restore configuration from a known-good backup, and rotate ISE admin, RADIUS/TACACS+ shared secrets and integration credentials.

### How to check if you are affected

- Run show logging application ise-kong/access.log | include dummyuser on every node; any output may indicate malicious activity.
- Collect a support bundle with debug logs and review older ./ise/logs/apigateway/access.log.*.gz files for suspicious usernames.
- Check firewall and network logs outside ISE for unexpected uploads from ISE nodes to external IPs or downloads from suspicious addresses.
- Review ISE admin accounts, authorization policies and network device definitions for changes nobody on your team made.

## What happened

On September 16, 2026, Cisco published [CVE-2026-76460](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5), an authentication bypass in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The cause is "insufficient authentication control on an API endpoint". An unauthenticated attacker who sends a crafted request to that endpoint gets into the device without going through the web-based management interface. Cisco scores it CVSS 3.1 10.0 (Critical) and says its PSIRT is aware of active exploitation. Cisco also warns that after a successful exploit, "threat actors may obtain command execution with root privileges" and may then remove or hide evidence.

CISA added the CVE to the [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460) the same day, with a September 19 deadline for federal agencies. Its ransomware status is "Unknown", and CISA flags it for forensic triage. CISA's assessment in the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-76460) rates exploitation automatable and the technical impact "total". Cisco found the bug while resolving a TAC support case and has not described the attacks.

## Who is affected

ISE and ISE-PIC are affected regardless of configuration. The first fixed releases are:

- 3.1: 3.1 Patch 12
- 3.2: 3.2 Patch 11
- 3.3: 3.3 Patch 12
- 3.4: 3.4 Patch 7
- 3.5: 3.5 Patch 4

ISE 3.0 has reached end of software maintenance, and Cisco tells those customers to migrate to a supported fixed release. [Help Net Security](https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/) notes that the same release fixed many other ISE flaws, and that 3.1 and 3.2 now receive only critical fixes. That makes 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 the better targets. There is no workaround.

## Do you really need to act?

If you run ISE, yes, today. Every precondition favors the attacker: no credentials, no user interaction, no special configuration, and a changed scope in the CVSS vector. ISE sits at the center of network access control, and a compromised ISE node can change who gets onto wired, wireless and VPN networks. It also holds RADIUS and TACACS+ shared secrets, network device credentials and directory integrations. Cisco's warning about root access and evidence removal means that patching alone does not prove you are clean.

ISE is usually deployed on internal networks, which narrows the field of attackers. It does not remove the risk, because Cisco documents no specific port or interface for the vulnerable API, and an attacker with any internal foothold can reach it. Cisco's only interim mitigation is infrastructure ACLs that allow just the management and control-plane traffic each node needs. [Bitsight](https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-76460-cisco-ise-authentication-bypass) also stresses that this does not replace patching. If you do not run ISE, nothing here applies to you, though it is worth asking managed network providers whether they do.

## What to do now

1. List every ISE and ISE-PIC node, including secondary admin, monitoring and policy service nodes in distributed deployments. Check the release and installed patch with `show version` on each node.
2. Install the fixed patch for your train on all nodes, or migrate 3.0 deployments to a supported release.
3. Until every node is patched, apply infrastructure ACLs so only the management stations and network devices that need ISE can reach it.
4. Run the indicator check on *every* node, not just the primary: `show logging application ise-kong/access.log | include dummyuser`.
5. If anything looks suspicious, follow Cisco's advice: re-image the affected nodes and restore configuration from backup. Then rotate the ISE admin passwords, RADIUS/TACACS+ shared secrets and the service accounts ISE uses for Active Directory and other integrations.

## How to tell if you were hit

Cisco's indicator lives in the API gateway (Kong) access log. Look for suspicious usernames, with `dummyuser` as a non-exhaustive example, and treat any matching entry as possible malicious activity. The live log only covers recent traffic. For older entries, collect a support bundle with debug logs included and shared-key encryption, decrypt it, and search `./ise/logs/apigateway/access.log.*.gz`. Because an attacker with root can wipe local logs, Cisco recommends checking telemetry outside the device as well: firewall and network logs showing unexpected uploads from ISE nodes to external IPs, or downloads from malicious addresses. Also review admin accounts, authorization policies and network device entries for changes you cannot explain.

## Timeline

- Sep 16, 2026 — Cisco publishes the advisory and fixed patches, citing active exploitation. CISA adds CVE-2026-76460 to KEV.
- Sep 17, 2026 — CISA's exploitation assessment is added to the CVE record, and press and vendor write-ups follow.
- Sep 19, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Cisco — Cisco Identity Services Engine Authentication Bypass Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5)
2. [CVE record — CVE-2026-76460](https://www.cve.org/CVERecord?id=CVE-2026-76460)
3. [NVD — CVE-2026-76460](https://nvd.nist.gov/vuln/detail/CVE-2026-76460)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-76460](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460)
5. [Bitsight — CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation](https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-76460-cisco-ise-authentication-bypass)
6. [Help Net Security — Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460)](https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/)

---
Source page: https://erroneo.us/security/briefs/cisco-ise-cve-2026-76460-api-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt