Cisco ISE Authentication Bypass CVE-2026-76460: What Defenders Need to Do Now
When a vendor confirms active exploitation of a CVSS 10.0 flaw, the useful question is not whether to patch but how quickly and what to check in the meantime. CVE-2026-76460 in Cisco Identity Services Engine is that situation: unauthenticated attackers can reach root, and Cisco says the flaw is already in use.
Vulnerability overview
CVE-2026-76460 is an authentication bypass affecting Cisco ISE and ISE-PIC, disclosed September 16, 2026, with a CVSS score of 10.0. Cisco PSIRT confirmed active exploitation and found the issue while resolving a Technical Assistance Center support case.
Mechanism and exploitation conditions
Cisco describes the cause as "insufficient authentication control on an API endpoint." An attacker sends crafted requests to the exposed endpoint. The endpoint does not enforce authentication correctly, so the request bypasses the web management interface and the attacker executes commands as root.
The conditions are straightforward: the endpoint must be reachable over the network, and no authentication is required. The advisory adds that attackers can erase log entries, so investigators should account for deliberate anti-forensic behavior.
Impact
Root access to Cisco ISE gives an attacker control over network access policy. They can modify access rules, cover their tracks, and pivot into internal subnets. Because ISE underpins network admission decisions, its compromise can weaken the security posture of systems that trust it.
Affected products and scope
Cisco ISE and Cisco ISE-PIC are affected in all device configurations, across releases 3.1 through 3.5. No temporary workaround is available.
Exposure context
ZoomEye shows 4,051 instances matching app="Cisco ISE". The direct CVE query vul.cve="CVE-2026-76460" returned 0, which is typical for a newly disclosed CVE not yet indexed by identifier. The product count indicates observable Cisco ISE footprint, not confirmed vulnerable assets.
Remediation and mitigations
Cisco shipped fixes as 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Patch to the release matching your deployment as a priority.
Since no workaround exists, reduce exposure with infrastructure ACLs that block untrusted traffic from ISE management interfaces, and review access logs for dummyuser account entries as a detection signal.
