Cisco Identity Services Engine authentication bypass CVE-2026-76460 exploited; patches out for 3.1–3.5
Cisco ISE and ISE-PIC have a CVSS 10 login bypass (CVE-2026-76460) that attackers are already using. Fixed in 3.1 Patch 12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4. Mainly a business system: patch, and re-image any node showing signs of compromise.
If you run Cisco ISE or ISE-PIC, install the fixed patch for your branch now, and keep its management interfaces off the internet. If a node may have been compromised, Cisco advises re-imaging it. Families with no ISE system have nothing to do.
What’s happening
Cisco Identity Services Engine (ISE), the network access control system many organisations use to decide who can join their networks, and its ISE Passive Identity Connector (ISE-PIC) have a maximum-severity flaw, CVE-2026-76460. An API endpoint does not check authentication properly, so a remote attacker with no password can bypass the web management interface. Cisco says this affects all configurations and may let attackers run commands as root and erase evidence. Cisco published its advisory on 16 September 2026 and said its security team is aware of active exploitation. CISA listed the flaw as exploited the same day. Cisco has released fixes for each supported branch: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Release 3.0 is no longer maintained and must be moved to a supported release. There is no workaround, though limiting access to the management interface with network access lists reduces exposure. No attacker has been named, and the number of affected systems is not published.
- What
- Flaw
- Affects
- Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC)
- Affected
- Cisco Identity Services Engine (ISE) releases 3.0 to 3.5, regardless of configuration
Cisco ISE Passive Identity Connector (ISE-PIC) - Fixed in
- 3.1 Patch 12
3.2 Patch 11
3.3 Patch 12
3.4 Patch 7
3.5 Patch 4
3.0 is end of maintenance: migrate to a fixed supported release - Since
- 16 Sept 2026
- Closed
- 17 Sept 2026
Timeline
- Update
Bitsight's analysis repeated Cisco's fixes and added detection advice: check ise-kong/access.log on every node for suspicious usernames, and re-image any node suspected of compromise. No attacker was named and no exposure count was given.
- CISA added
CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog, with US federal civilian agencies required to fix it by 19 September.
- Made publicFixed
Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 for CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass in Cisco ISE and ISE-PIC. Cisco said its PSIRT was aware of active exploitation, listed fixed patches for the 3.1 to 3.5 branches, and said there was no workaround.
Sources
- Cisco Identity Services Engine Authentication Bypass VulnerabilityCisco · 16 Sept 2026
- Cisco warns of Identity Service Engine zero-day exploited in attacksBleepingComputer · 17 Sept 2026
- CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitationBitsight · 17 Sept 2026