CVE-2026-76460: Maximum-Severity Cisco ISE Authentication Bypass Under Active Exploitation
Cisco's Identity Services Engine (ISE) sits at the center of network access control for many enterprises. On September 16, 2026, Cisco disclosed that a maximum-severity flaw in that platform is being exploited in the wild. The bug, tracked as CVE-2026-76460, carries a CVSS score of 10.0 and lets an unauthenticated remote attacker bypass authentication on an API endpoint and gain root privileges on the appliance.
Vulnerability overview
CVE-2026-76460 is an authentication bypass in Cisco ISE and Cisco ISE-PIC. Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation. The vendor discovered the defect while working a Technical Assistance Center support case, which suggests real-world activity rather than a purely theoretical finding.
The advisory states that the flaw stems from "insufficient authentication control on an API endpoint." That single sentence carries most of the technical weight: the exposed endpoint does not adequately verify who is calling it, so a crafted request can reach functionality that should require credentials.
Mechanism and exploitation conditions
An attacker sends crafted network requests directly to an exposed API endpoint. Because the endpoint's authentication control is insufficient, the request bypasses the web management interface entirely. From there, the attacker can execute commands with root privileges on the underlying system.
The exploitation conditions are narrow but not exotic. The endpoint must be reachable by the attacker, typically over the network. No prior authentication is required, which is what makes the flaw severe: there is no credential barrier between an unauthenticated network position and root-level command execution. The advisory also notes that attackers can erase log entries to conceal their activity, complicating post-incident forensics.
Impact
Successful exploitation grants root control of a Cisco ISE deployment. ISE enforces identity and access policy across enterprise networks, so an attacker who owns the appliance can manipulate access rules and pivot deeper into internal subnets. Because ISE is a trust anchor for network admission, compromising it can undermine the controls that other systems rely on. The ability to wipe logs adds a second problem: defenders may not see the intrusion until it is well advanced.
Affected products and scope
The vulnerability affects Cisco ISE and Cisco ISE-PIC across all device configurations. Affected releases run from 3.1 through 3.5. Cisco has not published a temporary workaround, which raises the stakes for organizations that cannot patch quickly.
Exposure context
A ZoomEye query for the product fingerprint app="Cisco ISE" returned 4,051 matching instances globally. A separate CVE filter, vul.cve="CVE-2026-76460", returned 0, which is expected for a recently disclosed CVE that ZoomEye has not yet indexed under that identifier. The product-query count describes assets matching the Cisco ISE fingerprint; it does not confirm that every one of those assets is vulnerable to this specific CVE.
Remediation and mitigations
Cisco released fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Administrators should deploy the appropriate patch for their branch immediately, given confirmed exploitation.
There is no vendor-provided workaround. Defenders can reduce exposure by using infrastructure access control lists to block untrusted traffic from reaching ISE management interfaces. Teams should also review access logs for suspicious dummyuser account entries, which the advisory flags as an indicator worth checking.
References
- Cisco PSIRT advisory for CVE-2026-76460 (via SecurityOnline.info report): https://securityonline.info/cisco-ise-vulnerability-exploited/
- CISA Known Exploited Vulnerabilities Catalog addition: https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
