CVE-2026-76460: Cisco ISE API authentication bypass via insufficient access control

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0 unauthenticated network authentication bypass in a core network access control system that is listed in CISA KEV with a three-day remediation deadline.

What it is

Cisco Identity Services Engine contains an authentication bypass in an API endpoint caused by insufficient authentication control. An unauthenticated remote attacker can send a crafted request to reach the web-based management interface without valid credentials. Because ISE governs network access policy, compromise of the device undermines trust decisions across the environment.

Impact

An attacker gains unauthorized access to the affected device, effectively bypassing the web-based management interface authentication. From there they can reach management functionality with the privileges the bypassed endpoint exposes, with high confidentiality, integrity and availability impact per the CVSS vector.

Attack surface

Reachable over the network via a crafted request to an affected API endpoint; no authentication and no user interaction are required (AV:N/AC:L/PR:N/UI:N). The record does not specify which endpoint or whether the interface must be internet-exposed.

Exploitation

CVE-2026-76460 was added to CISA KEV on 2026-09-16 with a remediation due date of 2026-09-19, indicating known exploitation in the wild. EPSS is listed as unknown and no ransomware campaign use is documented.

What to do

• Apply the Cisco security advisory (cisco-sa-ISE-ABP-VNSW7Tn5) fixes for Identity Services Engine and Passive Identity Connector immediately, meeting the CISA KEV due date.
• If patching cannot be completed, apply the vendor-listed mitigations or restrict/disable the affected API endpoint per Cisco guidance.
• Remove internet exposure of ISE management and API interfaces; place them behind management networks, VPN or allowlisted administrative hosts.
• Follow CISA BOD 26-04 guidance for exposed assets, including evaluating each asset's internet exposure and discontinuing use where mitigations are unavailable.
• Rotate credentials and review administrative accounts and configuration for signs of unauthorized access after exposure.

Detection

• Review ISE and reverse-proxy/web logs for unauthenticated or anomalous requests to API endpoints, especially successful responses without prior authentication.
• Alert on new or unexpected administrative sessions, configuration changes, and policy or identity source modifications in ISE audit logs.
• Monitor for access to ISE management interfaces from unexpected source IPs or geographies, and for scanning activity against ISE API paths.
• Correlate network and host telemetry for post-exploitation activity on ISE appliances, including new accounts, certificate changes and outbound connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.