CVE-2026-76460 – Critical Authentication Bypass in Cisco Identity Services Engine
TL;DR
- Critical severity, CVSS 10.0 remote authentication bypass.
- Affects Cisco ISE and ISE-PIC versions 3.1.0 – 3.5.0.
- Active exploitation observed; CISA KEV inclusion.
- No workaround; patch to fixed releases immediately.
- Potential for full device compromise, including root command execution.
Overview
CVE-2026-76460 is a Critical authentication bypass vulnerability in an API of the Cisco Identity Services Engine (ISE). The flaw stems from insufficient authentication control on a specific API endpoint, allowing an unauthenticated remote attacker to bypass the web-based management interface and gain unauthorized access to the device.
Technical Details
The vulnerability is classified as CWE-648 (Incorrect Use of Privileged APIs). An attacker can send a crafted HTTP request to the affected endpoint, circumventing authentication checks. Because the endpoint lacks proper authorization, the request is processed with elevated privileges, leading to full compromise of the ISE appliance.
Example request (simplified):
GET /api/v1/admin/privileged HTTP/1.1
Host: target-ip
Content-Type: application/json
A successful exploit can result in arbitrary command execution, configuration changes, and complete control of the network access control infrastructure.
Severity & Impact
| Metric | Value |
|---|---|
| Severity | Critical |
| CVSS Score | 10.0 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CWE | CWE-648 |
The attack requires no authentication, has low complexity, and can impact confidentiality, integrity, and availability of the ISE platform. Successful exploitation may enable lateral movement within the network and compromise of dependent services.
Affected Products
- Cisco Identity Services Engine (ISE) versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0
- Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0
For the full list of affected products and versions, see the CVE page.
Actionable Insights
- Immediate priority: Verify whether any ISE or ISE-PIC appliance is exposed to the network perimeter or untrusted segments.
- Monitor: Watch for anomalous API traffic, unexpected administrative logins, and changes to configuration.
- Detect: Review access logs for requests to the vulnerable endpoint, especially from external IPs.
- Contain: If exploitation is suspected, isolate the appliance and prepare for remediation.
Remediation & Mitigation
- patch – Upgrade to the fixed releases provided by Cisco (e.g., 3.1p12, 3.2p11, 3.3p12, 3.4p7, 3.5p4). Refer to the vendor advisory for exact version mapping.
- patching – If immediate patching is not possible, limit access to the ISE management interface to trusted internal networks using ACLs or firewall rules.
- Enable logging and alerting – Ensure syslog and access logs are forwarded to a SIEM for real‑time detection of suspicious API calls.
- remediation – After remediation, compare running configuration against a known‑good baseline to detect unauthorized changes.
- Reimage if compromised – If evidence of exploitation is found, follow Cisco’s guidance to reimage the appliance and rotate all credentials.
References
- Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460
- VulnSocial CVE Page: https://vulnsocial.com/cve/CVE-2026-76460
Bottom Line
CVE-2026-76460 is a Critical, remotely exploitable authentication bypass in Cisco ISE with a CVSS 10.0 score and confirmed active exploitation. Organizations must patch immediately, restrict management access, and monitor for signs of compromise.
#CVE #Critical #RCE #CISAKEV #CVE202676460