CVE-2026-76460

What is Cisco Identity Services Engine?

Cisco Identity Services Engine (ISE) is the network access control (NAC) platform at the center of many enterprise networks. It performs 802.1X and MAB authentication for wired, wireless, and VPN access, profiles devices, checks endpoint posture, and pushes authorization results (VLANs, downloadable ACLs, TrustSec tags) to switches and controllers. ISE Passive Identity Connector (ISE-PIC) is a reduced-function build that maps IPs to users for other Cisco security products. ISE is, by design, the system that decides who gets onto the network. Administrative access to it lets an attacker grant themselves access anywhere, disable enforcement, and harvest credentials and certificates for every connected user and device.

Overview

CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE and ISE-PIC caused by incorrect use of privileged APIs (CWE-648). An unauthenticated remote attacker can send a crafted request to a specific API endpoint and obtain administrative access to the web-based management interface. Cisco disclosed it on 2026-09-16 while confirming it was already being exploited, and CISA added it to KEV the same day. It is one of nine ISE CVEs Cisco published that day, several of them also critical.

Affected Versions

There are no workarounds. Cisco recommends infrastructure ACLs restricting management-plane traffic as an interim risk reduction only.

Technical Details

An API endpoint in ISE performs an action that requires administrative privileges but does not itself enforce authentication before calling into the privileged code path. This is the CWE-648 pattern: a trusted internal API is exposed through a route that lacks the authorization check the rest of the management interface relies on. A crafted request to that endpoint yields a session or token that the web management interface accepts as an administrator.

Attack characteristics:

• Authentication: none
• Complexity: low; a single crafted request
• Vector: network, to the ISE administration interface (typically TCP 443 on the admin node)
• Impact: full administrative control with scope change (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); Cisco notes that admin access on ISE can be escalated to root-level command execution on the underlying OS

The same-day advisory batch also fixed CVE-2026-20305 and CVE-2026-20306 (command injection, CVSS 9.1), CVE-2026-76423 (another CVSS 10.0 REST API authentication bypass), and CVE-2026-76424 (arbitrary file access leading to RCE). Organizations should treat the whole batch as one patching event.

Discovery

Cisco found the vulnerability while resolving a Technical Assistance Center (TAC) support case, tracked as Cisco bug CSCww39530. That origin implies at least one customer environment was compromised before Cisco identified the root cause.

Exploitation Context

Cisco PSIRT stated at publication that it was aware of exploitation in the wild. CISA confirmed exploitation and added the CVE to KEV on the disclosure date with a three-day deadline, its shortest tier. As of 2026-09-16 there is no public attribution to a named threat actor, no published proof of concept, and no published exposure count. ISE admin interfaces are not normally internet-facing, but ISE is also reachable from any internal segment that can talk to the admin node, so an attacker with an initial foothold inside the network can exploit it laterally.

Remediation

1. Patch every ISE and ISE-PIC node to the first fixed release for its train. Patch the primary administration node first, then secondaries, PSNs, and MnT nodes, following Cisco's patch ordering guidance for deployments.
2. Restrict the management plane now. Apply infrastructure ACLs so that only jump hosts and administrator subnets can reach the ISE admin interface on TCP 443 and the ERS/OpenAPI ports (TCP 9060 and 9070 by default).
3. Review access.log and the ISE audit log for logins by unfamiliar administrator usernames, admin sessions with no matching interactive login, and API calls from unexpected source IPs. Because root access allows log tampering, corroborate with firewall and proxy logs collected off-box.
4. Audit ISE configuration for persistence. Check for new admin users, changed authorization policies, new network device entries, and modified certificates or trusted CAs.
5. Rotate secrets held by ISE if any indicator is found: RADIUS and TACACS+ shared secrets, AD join account, LDAP bind credentials, pxGrid certificates, and API credentials for integrated systems.
6. Apply the rest of the 2026-09-16 ISE advisory batch in the same maintenance window; the fixed releases above cover the other critical CVEs as well.