Cisco patches actively exploited authentication bypass in ISE and ISE-PIC
Summary
Cisco patched an actively exploited authentication bypass in ISE and ISE-PIC that allows unauthenticated remote access to a management API and may enable root-level command execution. Upgrade to a fixed release and restrict management access.
Key points
- CVE-2026-76460 affects Cisco ISE and ISE-PIC versions 3.0 through 3.5, regardless of deployment configuration.
- Cisco says the flaw is actively exploited; CISA added it to the Known Exploited Vulnerabilities catalog.
- A remote, unauthenticated attacker able to reach the affected management API can bypass authentication; exploitation may lead to root-level command execution.
- Cisco fixed the vulnerability in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Cisco reported no software workaround.
- Restrict management access to dedicated networks and trusted administrative workstations; iACLs, firewalls, and segmentation can reduce exposure while updates are deployed.
- Review API gateway logs on every node and correlate them with external telemetry; investigate suspicious access and connected systems, and re-image confirmed-compromised nodes from trusted backups.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- CVSS 10.0
- Affected Versions
- Cisco ISE versions 3.0 through 3.5
- Cisco ISE-PIC versions 3.0 through 3.5
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Use infrastructure access control lists (iACLs), firewall rules, and network segmentation to restrict access to affected management interfaces while updates are deployed.
CVE
Vendors
Products
Cisco ISEAn actively exploited authentication bypass vulnerability in Cisco ISE and Cisco ISE-PIC allows remote, unauthenticated access to a management API and may lead to root-level command execution.Cisco ISE-PICAn actively exploited authentication bypass vulnerability in Cisco ISE and Cisco ISE-PIC allows remote, unauthenticated access to a management API and may lead to root-level command execution.