Cisco Patches Actively Exploited ISE Authentication Bypass
Summary
Cisco says attackers are exploiting CVE-2026-76460, an authentication bypass in ISE and ISE-PIC. No workaround exists; Cisco and CISA urge patching, and Cisco advises investigating logs and re-imaging systems if compromise is suspected.
Key points
- CVE-2026-76460 affects Cisco Identity Services Engine (ISE) and ISE-PIC and allows remote authentication bypass through an API endpoint.
- Cisco confirmed active exploitation and says the vulnerability can enable unauthorized access to affected devices.
- No workaround is available. Fixed releases range from ISE 3.1 Patch 12 to 3.5 Patch 4, depending on the installed release.
- Cisco advises checking access.log files and firewall and network logs for suspicious activity; it recommends re-imaging affected nodes and restoring from backups if malicious activity is suspected.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within three days.
Article Details
- Vulnerability Types
- Authentication bypass
- Insufficient authentication control
- Severity
- Maximum severity
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
Vendors
Products
Cisco Identity Services EngineCisco has released emergency security updates for CVE-2026-76460, a maximum-severity authentication bypass flaw in Cisco Identity Services Engine (ISE) and ISE-PIC that attackers are actively exploiting.Cisco ISE-PICby exploiting a weakness in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of configuration.