VulnSocial

CVE-2026-76423Active Exploitation

MEDIUMCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exploit could allow the attacker to read and modify ISE configuration and identity data with administrative privileges.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 3 classified signals
  • Patch or workaround signal is available
  • 6 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 3 signals
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 4 mentions (2026-09-17); latest day: 1
  • 6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d
01234Mentions · 2026-09-16: 1Mentions · 2026-09-17: 4Mentions · 2026-09-18: 1Active Exploitation · 2026-09-17: 2Active Exploitation · 2026-09-18: 1Patch / Workaround · 2026-09-17: 3Patch / Workaround · 2026-09-18: 1Technical Details · 2026-09-16: 1Technical Details · 2026-09-17: 409-1609-1709-18
Signal classification3 categories
Active Exploitation
350.0%
Disclosure
233.3%
Patch
116.7%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-161
Disclosure1
2026-09-174
Active Exploitation2Disclosure1Patch1
2026-09-181
Active Exploitation1
Full discourse6 posts
  • starlabs@starlabs_sg
    Patch

    🚨 We went looking at Cisco ISE and got a buffet spread. CVE-2026-76423: unauth auth bypass, CVSS 10.0. Full admin, no login and many others. Patched. 9 CVEs for @CurseRed & Tevel Sho, part of ~30 we reported. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc

    Post summary

    The tweet announces CVE-2026-76423 with a CVSS 10.0 unauth auth bypass and states that it has been patched, referencing Cisco security advisories, with no PoC, exploit, or active exploitation details provided.

    2202262.1K
    10.4K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Active Exploitation

    🔴 Cisco, ISE ve Secure Firewall ürünlerinde çok sayıda kritik güvenlik açığını yayınladı! • CVE-2026-76460 — CVSS 10.0: Cisco ISE authentication bypass. Kimlik doğrulaması gerektirmiyor ve aktif olarak sömürülüyor. • CVE-2026-76423 — CVSS 10.0: ISE/ISE-PIC REST API authentication bypass. Unauthenticated admin access mümkün. • CVE-2026-20130 — CVSS 10.0: ISE/ISE-PIC injection sınıfı kritik açık. • CVE-2026-20192 — CVSS 10.0: ISE/ISE-PIC improper access control. • CVE-2026-20242 — CVSS 9.8: Secure FMC'de unauthenticated RCE, root yetkisiyle. • CVE-2026-20307 — CVSS 9.9: ISE'de authenticated RCE. • CVE-2026-20330 — CVSS 9.9: ASA/FTD/FMC'de kritik CWE-707 güvenlik açığı. Cisco, bu açıklar için güvenlik güncellemeleri yayınladı; ilgili advisories'de workaround bulunmadığı belirtiliyor. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T

    Post summary

    The tweet announces several critical Cisco vulnerabilities, explicitly noting that CVE-2026-76460 is actively exploited, and indicates that security patches have been released.

    00022472
    2.5K followersView on X
  • Centre canadien pour la cybersécurité@centrecyber_ca
    Active Exploitation

    #CyberAlerte | Vulnérabilités Cisco ISE et ISE-PIC Les organisations utilisant Cisco (ISE) et Cisco (ISE-PIC) devraient mettre à jour immédiatement les systèmes touchés. Cisco a confirmé l’exploitation active de la vulnérabilité CVE-2026-76460. https://www.cyber.gc.ca/fr/alertes-avis/al26-021-vulnerabilites-touchant-cisco-identity-services-engine-ise-cisco-ise-passive-identity-connector-ise-pic-cve-2026-20192-cve-2026-76423-cve-2026-76460 https://t.co/vLiwWtuwaD

    Post summary

    The Canadian Cyber Centre alerts that Cisco has confirmed active exploitation of CVE-2026-76460 in ISE and ISE-PIC, urging immediate patching of affected systems.

    00000123
    3.7K followersView on X
  • SecureChap@SecureChap
    Active Exploitation

    Active exploitation confirmed on Cisco ISE authentication bypass CVE-2026-76460. The flaw lets remote attackers reach the web management interface without credentials through insufficient API controls. No workarounds exist. CISA added the issue to KEV in September 2026 and gave federal agencies a three-day patch deadline. Affected releases run 3.1 through 3.5. Fixed versions: - 3.1 Patch 12 - 3.2 Patch 11 - 3.3 Patch 12 - 3.4 Patch 7 - 3.5 Patch 4 The same patches also closed CVE-2026-76423 and five other critical issues. Check access.log on every node for suspicious usernames. Confirm current patch level on each ISE and ISE-PIC instance. Patch immediately or remain exposed.

    Post summary

    The CVE is confirmed to be actively exploited, with CISA KEV inclusion and a patch deadline, and fixed versions are provided.

    0000073
    172 followersView on X
  • zoomeyebot@zoomeyebot
    Disclosure

    🚨 Cisco ISE API Authentication Bypass (CVE-2026-76423, CVSS 10.0) Reaches Admin Access Critical Vulnerability Alert! Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector is affected by CVE-2026-76423. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco Identity Services Engine" Exposure: 883.6k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBJZGVudGl0eSBTZXJ2aWNlcyBFbmdpbmUi Cisco,ISE,CVE-2026-76423,AuthenticationBypass,NetworkSecurity

    Post summary

    The tweet announces CVE-2026-76423, an authentication bypass in Cisco ISE with CVSS 10.0, and shares ZoomEye search details for locating vulnerable instances, but provides no patch, exploit, or PoC information.

    0000054
    23 followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    🚨 CRITICAL — CVE-2026-76423 Cisco Identity Services Engine Vulnerabilities CVSS 10.0 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-76423 #Cisco #CyberSecurity #InfoSec

    Post summary

    The post announces a critical Cisco Identity Services Engine vulnerability with a CVSS 10.0 and notes that no patch is yet available. It does not disclose a PoC, named exploit, active exploitation, or specific remediation.

    0000032
    90 followersView on X

Explore more

Back to dashboard