Critical Cisco ISE Authentication Bypass CVE-2026-76460 Under Active Exploitation
Summary
Cisco confirms active exploitation of CVE-2026-76460, a critical unauthenticated remote authentication bypass in ISE and ISE-PIC that may enable root-level command execution. Cisco urges patching and recommends re-imaging if compromise is suspected.
Key points
- The flaw affects Cisco ISE and ISE-PIC regardless of device configuration and can be exploited remotely without credentials or user interaction.
- Cisco warns successful exploitation may enable command execution with root privileges; attackers may also hide or remove evidence.
- The vulnerability has a CVSS v3.1 score of 10.0. Cisco confirmed active exploitation, and CISA added it to the Known Exploited Vulnerabilities catalog on September 16, 2026.
- Fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. ISE 3.0 users should migrate to a supported fixed release.
- Cisco provides no workaround; it recommends restricting management and control-plane traffic with infrastructure access control lists until systems are patched.
- Review logs on every node, including ise-kong/access.log, and check external network and firewall telemetry. Cisco recommends re-imaging affected nodes and restoring from backup if compromise is suspected.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical; CVSS v3.1 score 10.0
- Affected Versions
- Cisco ISE 3.1 before Patch 12
- Cisco ISE 3.2 before Patch 11
- Cisco ISE 3.3 before Patch 12
- Cisco ISE 3.4 before Patch 7
- Cisco ISE 3.5 before Patch 4
- Cisco ISE-PIC 3.1 before Patch 12
- Cisco ISE-PIC 3.2 before Patch 11
- Cisco ISE-PIC 3.3 before Patch 12
- Cisco ISE-PIC 3.4 before Patch 7
- Cisco ISE-PIC 3.5 before Patch 4
- Cisco ISE 3.0 (end of software maintenance)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- No workaround is provided. Temporarily restrict management and control-plane traffic to affected devices using infrastructure access control lists.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterCisco warns successful exploitation may provide command execution with root privileges.T1190 · Exploit Public-Facing ApplicationThe vulnerability is remotely exploitable through a crafted request to an affected API endpoint, allowing access to the web-based management interface.
CVE
Vendors
Products
Cisco Identity Services EngineCisco has disclosed a critical authentication bypass affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Tracked as CVE-2026-76460, the vulnerability allows anCisco ISE-PICa critical authentication bypass affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Tracked as CVE-2026-76460, the vulnerability allows an unauthenticated, remote