Cisco ISE CVE-2026-76460: CVSS 10.0 Auth Bypass Under Active Attack Gives Unauthenticated Root

Introduction

Cisco admins who spent this week patching Secure Email Gateways now have a second emergency: CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). An unauthenticated remote attacker can send a crafted request to an insufficiently protected API endpoint, skip the web-based management login entirely, and execute commands as root. Cisco PSIRT confirmed active exploitation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on September 16 with a federal due date of September 19 and forensic triage required under BOD 26-04.

What Happened

ISE is the network access control plane for a large share of enterprise campuses: 802.1X, VPN posture, guest portals, and RADIUS/TACACS+ decisions all flow through it. Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on September 16, 2026. The bug is CWE-style incorrect use of privileged APIs — the management API does not apply sufficient authentication controls, so a crafted request bypasses the web UI regardless of how the appliance is configured.

No credentials and no user interaction are required. Successful exploitation yields root-level command execution. Cisco explicitly warned that an attacker with that access can wipe or conceal local indicators, which is why appliance logs alone are not a reliable "we were not hit" signal. The issue was found while Cisco TAC was working a support case. Cisco has not named the actor, the dwell time, or what operators did after getting in.

There is no workaround. Infrastructure ACLs that restrict management and control-plane traffic are only a temporary mitigation. First fixed releases:

  • ISE / ISE-PIC 3.1 Patch 12
  • 3.2 Patch 11
  • 3.3 Patch 12
  • 3.4 Patch 7
  • 3.5 Patch 4

ISE 3.0 is end of software maintenance and must be migrated to a supported train that includes the fix. Cisco shipped the ISE advisory as part of a larger September 16 batch that included additional maximum-severity ISE issues; CVE-2026-76460 is the one with confirmed in-the-wild use.

This disclosure landed days after CVE-2026-76461, the actively exploited SQL-injection-to-root bug in Cisco Secure Email Gateway. Two Cisco edge products, two unauthenticated root paths, one week.

Why It Matters

Compromising ISE is not the same as compromising a leaf switch. ISE holds RADIUS shared secrets, certificate material, posture policies, and the decision path for who gets on the network. Root on ISE is a standing invitation to mint access, disable posture checks, and persist in a place that most EDR agents never see.

The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N plus high confidentiality, integrity, and availability, with changed scope in Cisco's scoring) is the honest rating: any host that can reach the management API can try this. Internet-exposed ISE nodes are the emergency. Internal-only nodes are still in scope the moment an attacker has a foothold on a management VLAN.

Because the implant-or-cleanup stage can erase local evidence, organizations that "patched and moved on" without looking at upstream firewall logs are guessing.

Who Is Affected

  • Every Cisco ISE and ISE-PIC deployment not yet on a first-fixed patch listed above, regardless of configuration
  • ISE 3.0 estates that cannot patch in place and must migrate
  • Distributed ISE deployments — patch and hunt every node, not only the PAN
  • Any environment where the ISE admin/API ports are reachable from outside a tightly scoped management network
  • Downstream: every 802.1X, VPN, and guest-access decision that ISE currently enforces, plus the secrets stored on the appliance

How to Protect Yourself

1. Inventory every ISE / ISE-PIC node and confirm the running patch level.

ise/admin# show version
ise/admin# show application status ise

On Linux jump hosts that SSH to a node list:

for host in $(cat ise_nodes.txt); do
  echo "=== $host ==="
  ssh admin@"$host" 'show version | include "Cisco Identity Services Engine|Patch"'
done

2. Upgrade to a first-fixed release immediately. Use Cisco's ISE upgrade runbook for your train. There is no hot patch and no configuration toggle that closes the API gap. Prefer 3.5 Patch 4, 3.4 Patch 7, 3.3 Patch 12, 3.2 Patch 11, or 3.1 Patch 12. Migrate 3.0.

3. Restrict management-plane reachability while you patch. Temporary iACLs on upstream routers/firewalls should allow only the jump-host / admin VLAN to hit ISE admin and API ports:

! example: permit admin VLAN, deny the rest of RFC1918 + internet to ISE mgmt
ip access-list extended ISE-MGMT-IN
 permit tcp 10.10.50.0 0.0.0.255 host <ISE_MGMT_IP> eq 443
 deny   ip any host <ISE_MGMT_IP>
 permit ip any any

Do not leave ISE admin on a data interface.

4. Hunt as if local logs may already be untrustworthy. Cisco's own guidance is to review ISE access logs for suspicious usernames on every node, then correlate with external network and firewall logs for unexpected uploads/downloads from the appliance.

# on a syslog collector that is NOT the ISE box
grep -E 'CISE_Alarm|CISE_Passed_Authentications|Administrator' /var/log/ise/*.log |
  awk '{print}' | tail -n 200

# firewall / proxy: outbound from ISE management IPs since at least 1 Aug 2026
# look for dest IPs the appliance has no business talking to

On the appliance CLI, dump recent admin authentications and compare them to your known jump-host list. Anything you cannot explain is an incident until proven otherwise.

5. If you find credible evidence of exploitation, reimage. Cisco strongly recommends reimaging affected nodes and restoring configuration from a known-good backup taken before the suspected window. Do not "clean" a root-level compromise on a NAC appliance. After rebuild:

  • Rotate RADIUS/TACACS+ shared secrets
  • Re-issue admin certificates (do not merely renew)
  • Reset local admin passwords and any API client credentials
  • Review every ISE admin account and disable anything you did not create

6. Treat this as a BOD 26-04 forensic-triage event even if you are not a federal agency. Preserve core dumps, packet captures of the management plane, and off-box syslog from before the upgrade. Patching without that evidence destroys the only record of whether the 10.0 was used against you.

Source