{"id":"cisco-ise-api-auth-bypass-sep-2026","category":"patch","status":"closed","title":"Cisco Identity Services Engine authentication bypass CVE-2026-76460 exploited; patches out for 3.1–3.5","tldr":"Cisco ISE and ISE-PIC have a CVSS 10 login bypass (CVE-2026-76460) that attackers are already using. Fixed in 3.1 Patch 12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4. Mainly a business system: patch, and re-image any node showing signs of compromise.","summary":"Cisco Identity Services Engine (ISE), the network access control system many organisations use to decide who can join their networks, and its ISE Passive Identity Connector (ISE-PIC) have a maximum-severity flaw, CVE-2026-76460. An API endpoint does not check authentication properly, so a remote attacker with no password can bypass the web management interface. Cisco says this affects all configurations and may let attackers run commands as root and erase evidence. Cisco published its advisory on 16 September 2026 and said its security team is aware of active exploitation. CISA listed the flaw as exploited the same day. Cisco has released fixes for each supported branch: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Release 3.0 is no longer maintained and must be moved to a supported release. There is no workaround, though limiting access to the management interface with network access lists reduces exposure. No attacker has been named, and the number of affected systems is not published.","action":"If you run Cisco ISE or ISE-PIC, install the fixed patch for your branch now, and keep its management interfaces off the internet. If a node may have been compromised, Cisco advises re-imaging it. Families with no ISE system have nothing to do.","product":"Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-76460"],"tags":["cisco","ise","zero-day","authentication-bypass","cisa-kev","network-access-control"],"affected":["Cisco Identity Services Engine (ISE) releases 3.0 to 3.5, regardless of configuration","Cisco ISE Passive Identity Connector (ISE-PIC)"],"fixed":["3.1 Patch 12","3.2 Patch 11","3.3 Patch 12","3.4 Patch 7","3.5 Patch 4","3.0 is end of maintenance: migrate to a fixed supported release"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Identity Services Engine Authentication Bypass Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5","by":"Cisco","date":"2026-09-16"},{"kind":"news","title":"Cisco warns of Identity Service Engine zero-day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/","by":"BleepingComputer","date":"2026-09-17"},{"kind":"research","title":"CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation","url":"https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-76460-cisco-ise-authentication-bypass","by":"Bitsight","date":"2026-09-17"}],"started":"2026-09-16","closed":"2026-09-17","created":"2026-11-03T22:08:44.467Z","updated":"2026-11-03T22:08:44.467Z","cve_notes":[{"cve":"CVE-2026-76460","name":"Authentication bypass in Cisco ISE API endpoint","what":"An API endpoint in Cisco ISE and ISE-PIC does not check authentication properly, so a remote attacker with no password could bypass the management interface, and may gain root-level command execution.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-09-17","added":"2026-11-03T22:05:27.736Z","kind":"other","text":"Bitsight's analysis repeated Cisco's fixes and added detection advice: check ise-kong/access.log on every node for suspicious usernames, and re-image any node suspected of compromise. No attacker was named and no exposure count was given.","url":"https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-76460-cisco-ise-authentication-bypass","by":"Bitsight","patch":null},{"at":"2026-09-16","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog, with US federal civilian agencies required to fix it by 19 September.","url":"https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-09-16","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 for CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass in Cisco ISE and ISE-PIC. Cisco said its PSIRT was aware of active exploitation, listed fixed patches for the 3.1 to 3.5 branches, and said there was no workaround.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5","by":"Cisco","patch":"patched"}],"url":"https://hard.fyi/live/cisco-ise-api-auth-bypass-sep-2026/","json":"https://hard.fyi/api/live?id=cisco-ise-api-auth-bypass-sep-2026"}