Cisco ISE CVSS 10.0 flaw has no safe workaround

Cisco has issued fixes for CVE-2026-76460, an actively exploited authentication-bypass vulnerability in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw has a maximum CVSS 10.0 rating and can let an unauthenticated remote attacker obtain command execution with root privileges.

ISE is Cisco’s network access control and identity-policy platform: it determines which users and devices can join an enterprise network and what they may access after joining. The vulnerable API is on the management side of that infrastructure. Cisco says a crafted request to an affected endpoint can bypass the web-based management interface without credentials, user interaction, or a configuration-dependent precondition.

Cisco publicly released its advisory on September 16, 2026 and says its Product Security Incident Response Team is aware of exploitation in the wild. The company found the issue while resolving a Technical Assistance Center support case, but has not identified the actor behind the attacks, disclosed when exploitation began, or said what attackers have done after gaining access.

Recommended reading

Vite scans hit 32,000 events chasing AWS and Azure secrets

Sergey Kuznetsov • Sep 14, 2026 • 4 min read

“There are no workarounds that address this vulnerability.”

Cisco offers infrastructure access control lists, or iACLs, to limit management and control-plane traffic to the appliance, but calls that a mitigation rather than a solution. Organizations with externally reachable management paths should use that restriction as an immediate containment measure, then upgrade rather than treating network filtering as a final fix.

What the API bypass gives an attacker

Cisco characterizes the underlying issue as insufficient authentication controls on an API endpoint. Its security advisory for CVE-2026-76460 says an attacker can send a crafted request to bypass authentication and gain unauthorized access to the affected device through the management interface.

A successful attacker may obtain root-level command execution, which permits modification of the appliance itself. Cisco specifically warns that an intruder at that privilege level may remove or hide evidence of exploitation. An apparently clean local access log is not sufficient evidence that an ISE node was untouched.

Cisco’s detection guidance reflects that limitation. Administrators should inspect access.log for suspicious usernames on every node in a distributed ISE deployment, not merely the primary node. The advisory gives dummyuser as a non-exhaustive example of a suspicious username and provides this CLI command:

show logging application ise-kong/access.log | include dummyuser

Additional API gateway access logs can be collected through a support bundle when debug logs are included. Cisco says those logs can be found after decryption at ./ise/logs/apigateway/access.log..gz. Any suspicious entry can indicate malicious activity, but the company explicitly cautions that root access gives attackers the ability to erase or conceal those local indicators.

Cisco tells responders to corroborate the appliance’s records with network and firewall logs held outside the affected device. It calls out unexpected uploads from the ISE system to external IP addresses and downloads from malicious IP addresses as activity worth investigating. If compromise is suspected, Cisco strongly recommends reimaging affected nodes and restoring configuration backups as needed. Applying the patch prevents future exploitation; it does not establish that a system was not already accessed.

Fixed releases and the 3.0 migration problem

The patch path depends on the installed ISE or ISE-PIC train. Cisco’s release map shows that this is not one universal update package. Each supported branch has a distinct first fixed patch level.

The catch is ISE 3.0. That version has reached end of software maintenance, so it has no listed fixed patch. Customers still running it must migrate to a supported release that includes the fix. That is a different incident response task from applying a patch inside an existing release train, particularly for deployments that need to validate hardware capacity and configuration compatibility before upgrading.

Cisco’s advisory also notes that upgrades require sufficient device memory and that administrators should ensure their existing hardware and software configurations remain supported on the destination release. Customers entitled to software through Cisco, an authorized reseller, or partner can obtain the updates through the usual support channels; customers unable to obtain a fixed release through their point of sale are directed to contact Cisco TAC with a serial number and the advisory URL.

The vulnerability applies to ISE and ISE-PIC regardless of device configuration. There is no cited optional feature to disable and no deployment setting identified as safely outside the affected set. The scoping question is which ISE software train an organization runs, whether its management and control-plane interfaces are reachable by untrusted networks, and whether any node has evidence of prior access.

CISA puts the flaw in its exploited-vulnerability catalog

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, alongside CVE-2026-87886, an Acronis Backup issue involving incorrect default permissions. CISA’s KEV notice says both entries were added based on evidence of active exploitation.

For Federal Civilian Executive Branch agencies, the listing creates a short deadline: they must patch or stop using affected ISE deployments by September 19, 2026. CISA’s Binding Operational Directive 26-04 prioritizes rapid remediation of publicly exposed vulnerabilities that yield total control of an asset after exploitation. The directive applies to those federal agencies, not every US organization, but CISA is urging all organizations to prioritize remediation of KEV-listed flaws.

CISA describes CVE-2026-76460 as an incorrect use of privileged APIs vulnerability. Cisco’s description is an authentication-control failure on an API endpoint. A remote request can cross an administrative trust boundary without valid authentication, after which the attacker may execute commands as root.

The federal deadline should not be confused with proof that a patch alone closes an existing incident. CISA’s notice emphasizes checking whether systems were compromised before updates were applied, and Cisco’s reimage guidance is the more conservative route once suspicious activity is found. Organizations that simply update and move on risk leaving a root-level foothold or altered configuration behind.

Another Cisco zero-day in a patch-heavy month

This alert follows Cisco’s disclosure of CVE-2026-76461, a separate actively exploited flaw rated 9.8 in Secure Email Gateway and Secure Email and Web Manager appliances. That bug could likewise lead to root access. The two issues affect different products and mechanisms, so a completed email-gateway patch project does not reduce exposure in ISE; security teams need separate asset inventories, release checks, and compromise reviews.

On August 11, 2026, we reported that Microsoft’s August Patch Tuesday fixed 400 vulnerabilities, including three zero-days. On August 7, 2026, attackers had already used an N-able N-central zero-day to reach customer networks, and the vendor required a second hotfix even for customers that had patched once. Cisco’s ISE incident has the same operational feature: the update is necessary, but the company’s warning about removable evidence means defenders must also investigate the time before remediation.

Cisco released CVE-2026-76460 as part of a larger September 16 advisory batch for ISE. That batch included two additional advisories with CVSS 10.0 scores and three remote-code-execution issues rated as high as 9.9. The supplied advisories do not establish that those other flaws are being exploited, and they should not be conflated with CVE-2026-76460's confirmed in-the-wild status. A maintenance window for this critical issue may be an opportunity to review the full ISE security update set.

Patch, hunt, then decide whether to rebuild

The immediate technical sequence is: restrict management and control-plane access with iACLs where that can be done safely; upgrade to the applicable fixed release; review access.log across all nodes; and correlate findings with independent firewall and network telemetry. A suspected compromise requires reimaging and restoring, because the affected appliance cannot be treated as a fully reliable forensic source after possible root access.

Cisco has not named the attackers, provided indicators beyond its log-hunting guidance, stated how widely the vulnerability has been exploited, or disclosed a public proof of concept. There are also no independent technical details on the crafted API request. Cisco confirms active exploitation, CISA has placed the bug in KEV, and ISE 3.0 users do not have a patch path at all.