Cisco ISE CVE-2026-76460: Patch the Actively Exploited Authentication Bypass

By AiCybr Editorial · Published September 17, 2026

Cisco has released fixes for CVE-2026-76460, a maximum-severity authentication-bypass vulnerability affecting Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Cisco assigns the flaw a CVSS 3.1 score of 10.0 and says its Product Security Incident Response Team is aware of active exploitation.

The vulnerability affects an API endpoint that applies insufficient authentication controls. A remote, unauthenticated attacker can send crafted requests and bypass authentication to the web-based management interface. Cisco warns that successful exploitation may lead to command execution with root privileges, giving a threat actor enough control to alter or remove local evidence.

CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) Catalog on September 16, 2026. For operators, the immediate priorities are to install a fixed ISE release, review every node for Cisco's published indicator, and treat positive findings as a potential full appliance compromise.

Fixed Cisco ISE releases

Cisco's September 16 advisory identifies the following first fixed releases:

The same vulnerability affects ISE-PIC. Cisco notes that ISE-PIC has reached end of sale and that 3.4 is its last supported release, making supported-version planning relevant alongside the immediate security update.

Cisco's advisory states that the vulnerability affects ISE and ISE-PIC regardless of device configuration. Exposure assessment should therefore start with software version and network reachability instead of relying on a feature being disabled.

Why CVE-2026-76460 is critical

ISE sits in a high-trust position in enterprise networks. It provides identity and policy services used to control access by users and endpoints. An unauthenticated path into the management plane can therefore expose a system that holds sensitive network-access policy and authentication context.

Cisco describes the root cause as insufficient authentication controls on a specific API. The attack is network reachable, requires no privileges and requires no user interaction, which is reflected in the 10.0 CVSS score.

Root-level command execution materially changes incident response. Local logs on a compromised node cannot be treated as the only evidence source because an attacker with root access can modify files, processes and audit artifacts. Cisco specifically recommends checking external network and firewall logs when investigating possible compromise.

Check ise-kong/access.log on every node

Cisco provides a concrete log check for suspicious activity. Administrators should inspect ise-kong/access.log for the unexpected username dummyuser. Cisco's published CLI example is:

show logging application ise-kong/access.log | include dummyuser

Any matching entry may indicate malicious activity. In a distributed ISE deployment, Cisco says the check should be performed on every node.

The local check should be paired with telemetry held outside ISE. Review firewall, proxy, load-balancer and network-flow records for unusual management-plane connections, unexpected uploads or downloads, and activity around the time of suspicious ISE requests. External records are particularly useful when local evidence may have been altered after root access.

Recovery when exploitation is suspected

Cisco recommends re-imaging affected nodes and restoring from configuration backup if needed when malicious activity is suspected. That is a stronger response than installing the patch over a system with evidence of compromise.

A practical response sequence is:

1. restrict management-plane reachability while preserving external logs and relevant forensic evidence;
2. identify the ISE and ISE-PIC versions on every node;
3. search each node's ise-kong/access.log for Cisco's published indicator;
4. correlate findings with firewall and other off-box telemetry;
5. re-image nodes where malicious activity is suspected and restore from a known-good configuration backup;
6. install the applicable fixed release before returning the node to normal service;
7. review credentials, certificates, integrations and administrative changes that could remain useful to an attacker after appliance recovery.

The final step matters because an ISE compromise can intersect with broader identity and network-control infrastructure. Recovery should account for connected systems and secrets exposed to the appliance, based on the organization's actual deployment.

Network mitigation while patching

Cisco lists no workaround that removes the vulnerability. It does identify infrastructure access control lists, or iACLs, as a mitigation to limit traffic reaching affected devices.

Management and control-plane access should be restricted to the systems and networks that genuinely require it. This reduces the remotely reachable attack surface while maintenance is being completed. Network restriction is a temporary exposure-reduction measure; Cisco's remediation is installation of a fixed software release.

Separate CVE-2026-76460 from Cisco's broader September ISE hardening release

Cisco published a large set of ISE security advisories on September 16. The same release cycle includes additional critical vulnerabilities covering authentication and authorization bypasses, remote code execution, SQL injection, XML external entity injection, command injection and other classes.

CVE-2026-76460 has a distinct operational priority because Cisco has confirmed active exploitation and CISA has placed it in KEV. Administrators should still use Cisco's September 2026 ISE hardening guidance to determine the supported release that incorporates the wider set of fixes rather than treating one CVE patch as the end of the maintenance cycle.

Cisco says the vulnerabilities grouped in its separate September ISE hardening release were found during internal security testing, including testing with frontier AI models, and reports no known malicious use of those hardening-release issues except where separately disclosed. That exploitation status should remain separate from the confirmed exploitation of CVE-2026-76460.

Bottom line

Any organization running Cisco ISE or ISE-PIC should verify its installed release immediately. The first fixed ISE levels are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.

CVE-2026-76460 combines unauthenticated network access, a CVSS 10.0 rating, potential root command execution and confirmed exploitation. Patch deployment should be accompanied by Cisco's dummyuser log check on every node and off-box log review. A positive compromise signal warrants re-imaging and recovery from known-good state rather than relying on an in-place update alone.

Sources

• Cisco Security Advisory, Cisco Identity Services Engine Authentication Bypass Vulnerability, September 16, 2026.
• Cisco, Advance Notification for Publication of September 16, 2026, Security Advisories.
• Cisco, Identity Services Engine Hardening Release: September 2026.
• CISA, Known Exploited Vulnerabilities Catalog.
• SecurityWeek, Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day, September 17, 2026.