Cisco has issued an urgent security advisory regarding a critical authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
This vulnerability, tracked as CVE-2026-76460, has a maximum CVSS score of 10.0 and could allow unauthenticated remote attackers to gain unauthorized access to vulnerable devices.
Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 details the vulnerability and was published on September 16, 2026. While Cisco has released software updates to address the issue, no workarounds are currently available. Therefore, administrators should prioritize patching affected deployments.
Critical Cisco ISE Flaw
According to Cisco, the problem originates from insufficient authentication controls on an API endpoint exposed by the affected ISE and ISE-PIC instances. An attacker could send a specially crafted request to this endpoint, bypassing the authentication protections on the web-based management interface.
If exploited, this vulnerability would allow a remote attacker without valid credentials to gain unauthorized access to the affected system. Cisco classifies the issue as CWE-648, which pertains to the incorrect use of privileged APIs or authentication mechanisms.
The CVSS v3.1 vector is: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
This rating reflects the vulnerability’s network-based attack surface, low attack complexity, lack of required privileges, and absence of user interaction. The flaw could impact the confidentiality, integrity, and availability of the ISE appliance, and the scope change indicates that a compromise could extend beyond the vulnerable component.
Affected Cisco Products
Cisco has confirmed that the flaw affects both Cisco ISE and Cisco ISE-PIC, regardless of device configuration. ISE-PIC is used to integrate identity information from enterprise directory and authentication systems into security products and access-control workflows.
Administrators should review the Fixed Software section of Cisco’s advisory to determine whether their installed release is vulnerable and to identify the appropriate upgrade path. Cisco Bug ID CSCww39530 is associated with this vulnerability.
Since no workaround exists, simply restricting management-interface exposure is insufficient as a substitute for applying Cisco’s software updates. Organizations should identify internet-facing, externally accessible, and internally reachable ISE management instances, then prioritize patch deployment based on their exposure and business criticality.
Cisco has provided guidance for identifying potential exploitation attempts. Administrators should inspect the access.log file for suspicious usernames, including unexpected account names linked to API requests.
An example command provided by Cisco is as follows:
admin#show logging application ise-kong/access.log | include dummyuserFor distributed ISE deployments, defenders must inspect logs from every node, not only the primary administration node. Additional access logs can be obtained by collecting a support bundle with debug logs enabled, using shared-key encryption, decrypting the bundle, and reviewing files under:
./ise/logs/apigateway/access.log..gzCisco warns that entries matching suspicious usernames may indicate malicious activity. If compromise is suspected, the company recommends reimaging affected nodes and restoring configurations from known-good backups as necessary.
Cisco has further cautioned that successful exploitation may grant threat actors command-and-control capabilities with root privileges. This level of access could allow attackers to alter logs, remove forensic artifacts, establish persistence, or conceal their activity on the appliance.
Therefore, defenders should not rely solely on evidence stored on the potentially compromised ISE device. Cisco recommends correlating appliance findings with external network telemetry, firewall logs, proxy records, and DNS data.
Security teams should investigate unexpected uploads from ISE appliances to external IP addresses, suspicious inbound downloads, unusual API activity, and anomalous behaviors from administrator accounts.
Organizations should treat CVE-2026-76460 as a high-priority incident related to identity infrastructure. Immediate steps such as patching, conducting enterprise-wide log reviews, correlating external telemetry, reviewing credentials, and preparing to rebuild affected nodes are essential for minimizing the impact of a potential compromise.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
