Cisco ISE CVE-2026-76460 is the central development. Cisco ISE CVE-2026-76460 is a maximum-severity authentication-bypass vulnerability that Cisco says attackers are actively exploiting. The September 16 advisory affects Cisco Identity Services Engine and ISE Passive Identity Connector regardless of configuration, has no workaround and requires an upgrade to a fixed release.
Cisco ISE CVE-2026-76460: what changed
| CVE | CVE-2026-76460 | Cisco; CISA |
|---|---|---|
| Severity | CVSS 10.0, critical | Cisco |
| Affected products | Cisco ISE and ISE-PIC, regardless of configuration | Cisco; BleepingComputer |
| Workaround | None | Cisco |
| Federal deadline | September 19, 2026 | CISA; The Hacker News |
The risk is unusually concentrated because ISE is a policy decision point for network access. It evaluates users and devices before granting access and can share identity context across an environment. An unauthenticated attacker who bypasses its management interface is not entering an ordinary application; the attacker is reaching infrastructure that helps decide who and what the network trusts.
Cisco attributes the flaw to insufficient authentication control on an API endpoint. A crafted request can bypass the web management interface and obtain unauthorised access. Cisco further warns that successful exploitation may lead to command execution with root privileges, giving an attacker the ability to hide or delete indicators of compromise.
That last point changes the response plan. A clean local log is not enough to prove a node was untouched if the attacker could alter evidence on the appliance. Cisco advises checking access.log on every node in a distributed deployment and cross-checking firewall and network telemetry outside the affected system.
Cisco lists five fixed release lines: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Release 3.0 is beyond software maintenance, so organisations still running it need to migrate to a supported version that contains the fix.
CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16. The agency set a September 19 remediation deadline for US federal civilian agencies under its current binding directive. That deadline is not a global legal requirement, but it is a useful signal for private organisations prioritising emergency change windows.
Cisco has not publicly identified the attackers or described the campaign. BleepingComputer, SecurityWeek and The Hacker News independently reported the active exploitation, patch matrix and absence of a workaround, but none supplies a basis for attributing the attacks to a named criminal or state group. Defenders should avoid filling that gap with speculation.
The immediate inventory should cover every ISE and ISE-PIC node, including standby and disaster-recovery systems that may not appear in ordinary application dashboards. Teams should record current versions, deployment roles, management exposure and whether backups are recent enough to support a clean rebuild.
Cisco recommends searching the ISE Kong access log for suspicious usernames. In a distributed cluster, the check belongs on each node because compromise evidence may not replicate consistently. Administrators should also preserve copies of logs before remediation and collect external DNS, proxy, firewall and flow records for the same period.
If evidence suggests malicious activity, Cisco recommends re-imaging affected nodes and restoring from configuration backup. A simple patch may close the vulnerable endpoint but does not remove an attacker who already obtained privileged access. Incident leaders should treat rebuild, credential rotation and trust re-establishment as separate tasks.
Indian enterprises often use ISE across campus, branch, data-centre and regulated environments. A rushed untested upgrade can interrupt authentication, but delay leaves an actively exploited control point exposed. The practical compromise is an emergency change with validated backups, staged node sequencing, health checks and a tested rollback that does not restore a compromised image.
Network segmentation remains useful while patches roll out. Cisco says infrastructure access control lists can restrict traffic to required management and control-plane sources, but explicitly does not call that a workaround. Restricted reachability reduces exposure; it does not correct the missing authentication control.
Security teams should also review service accounts and administrative credentials that passed through affected nodes. Because the vulnerable system participates in identity decisions, post-incident assurance should include checking integrations, certificates, API tokens and configuration changes rather than focusing only on the appliance operating system.
A change plan should name the business services that depend on ISE before maintenance begins. Wireless access, VPN authentication, device onboarding and segmentation policy may fail differently when a node restarts or leaves a cluster. Owners should monitor authentication latency, replication health and policy evaluation after each upgrade step instead of declaring success when the appliance merely boots.
Backups also require scrutiny. A configuration archive is valuable for rebuilding, but teams need to know when it was created and whether it predates suspicious activity. Restoring a recent backup without that timeline can reproduce malicious changes. Keep the original evidence copy separate, validate the chosen recovery point and document every decision for later review.
The patch matrix should be matched against actual running versions, not purchase records or a stale asset database. Virtual appliances, laboratory nodes and disaster-recovery instances can stay invisible until failover. Network discovery, hypervisor inventories and certificate records can reveal forgotten systems that still expose the vulnerable API.
After containment, leaders should ask why an identity-policy interface was reachable from the observed attack path. The answer may point to overbroad management access, weak administrative segmentation or monitoring gaps. Those architectural fixes reduce the impact of the next appliance vulnerability even though they do not replace the current Cisco update.
Post-upgrade validation should confirm that policy sets, node certificates, replication and integrations behave as expected. A short login test is insufficient for a system that can make different decisions by user, device posture, location and network segment.
Cisco ISE CVE-2026-76460 therefore requires two parallel actions: upgrade every affected node to a fixed release and investigate whether trust was already breached. Patching closes the known flaw. Off-box evidence, clean rebuilds where indicated and renewed credentials are what restore confidence in the identity control plane.
Related Lapaas Voice coverage
Read our coverage of Google Pixel zero-day response and ScreenConnect KEV response for adjacent context.
Frequently asked questions
What is Cisco ISE CVE-2026-76460?
Cisco confirms active exploitation of a CVSS 10 authentication-bypass flaw in ISE and ISE-PIC.
What changed in this event?
There is no workaround; fixed releases range from 3.1 Patch 12 through 3.5 Patch 4.
What should organisations do next?
Cisco warns root access can hide evidence, so defenders should check every node and external network logs.
Sources
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
