Table of contents
11
Read this in 30 seconds:
- CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) and ISE-PIC.
- No login needed. A crafted request to an API endpoint gets an attacker in, and it can end in root command execution.
- Cisco confirms it’s being exploited right now. CISA added it to the KEV catalog on September 16, 2026 and gave federal agencies until September 19 to patch.
- There’s no workaround. Restricting a port or disabling a feature doesn’t help. Patching is the only fix.
- It hits ISE regardless of how you’ve configured it, which is the part that should worry you most.
- Cisco’s same September disclosure window also carried several other maximum or near-maximum severity ISE bugs, so this patch cycle isn’t a one-and-done.
A CVSS 10.0 bug means every box got checked wrong: no login required, no user interaction, reachable over the network, total damage. CVE-2026-76460 checks every one of those boxes in Cisco ISE, the system a huge number of enterprises use to decide who and what gets network access in the first place. Here’s what it is, why it’s worse than a normal auth bypass, and what to actually do about it.
Cisco’s advisory (cisco-sa-ISE-ABP-VNSW7Tn5) comes down to one sentence: an API endpoint in ISE doesn’t check who’s calling it properly. Send it the right crafted request, and you’re in, without a password, a token, or a session cookie.
That alone would be bad. What makes it worse is where it lands. Successful exploitation can reach root command execution on the box. ISE isn’t a random app server, it’s the system deciding which devices and users get on your network. Root access there means an attacker isn’t just in one system, they’re sitting on the control plane that vouches for everything else.
Affected versions and the fix:
| ISE Release | Fixed In |
|---|---|
| 3.1 | Patch 12 |
| 3.2 | Patch 11 |
| 3.3 | Patch 12 |
| 3.4 | Patch 7 |
| 3.5 | Patch 4 |
Most critical Cisco bugs come with an escape hatch. Turn off a feature, restrict the management interface to a jump box, disable a listening service, buy yourself time while you schedule the patch window. Cisco says none of that works here. The bug hits ISE “regardless of device configuration.” That’s Cisco’s own wording, and it means your usual stopgap moves are off the table.
Here’s the part we think gets skipped in a lot of the coverage: this isn’t just an auth bypass, several reports on the exploitation activity describe attackers also wiping logs after getting in. That’s not incidental. It’s the difference between “we got popped and we know exactly what happened” and “we got popped and we’re not sure how far it went.” If you’re the team that has to answer “were we compromised” after the fact, a log-wiping step in the attack chain is the single detail that turns a bad day into a genuinely hard investigation.
Our honest read: treat this less like “patch when convenient” and more like “assume someone already tried the door.” Cisco’s own PSIRT confirmed active exploitation, reported widely before CISA even added it to KEV, which means this wasn’t found in a lab first.
Any organization running ISE or ISE-PIC on an unpatched release, full stop. This isn’t a niche edge case tied to one feature flag or integration. Because the flaw exists regardless of configuration, “we locked it down pretty well” doesn’t buy you the protection it normally would.
CISA’s Known Exploited Vulnerabilities catalog gave federal civilian agencies a three-day window, September 16 to September 19, to patch. That’s an unusually tight deadline even by KEV standards, and it’s CISA’s way of saying this one doesn’t wait for a normal patch cycle.
Worth knowing: Cisco’s broader September ISE/ISE-PIC disclosure window included other maximum and near-maximum severity bugs beyond this one, reporting on the exact count and CVSS scores has been inconsistent across outlets, so we’re not going to hand you a number we can’t stand behind. What we can say plainly: if you run ISE, this was not a one-CVE month. Check Cisco’s advisory page directly for your specific release before you consider yourself done.
access.log for suspicious usernames or requests you don’t recognize, this is Cisco’s own recommended first step if you suspect you were already hit.Brand note, kept short: this is exactly the kind of finding that shows why identity and access infrastructure needs the same scrutiny as anything customer-facing. A flaw in the system that decides who’s allowed on your network is worth more to an attacker than almost any single application bug, because it’s upstream of everything else you’re protecting. Human-led VAPT tests exactly these kinds of access-control assumptions the way a real attacker would, not with a generic scanner pass. XHack doesn’t store your findings on our servers either, engagement data stays local and fully deletable by you.
A CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) and ISE-PIC. An unauthenticated attacker can send a crafted request to a vulnerable API endpoint and get in, with successful exploitation able to reach root command execution.
Yes. Cisco’s own PSIRT confirmed active exploitation, and CISA added it to the Known Exploited Vulnerabilities catalog on September 16, 2026, with a three-day patch deadline for federal agencies.
No. Cisco states there’s no configuration-based mitigation, and the bug affects ISE regardless of how it’s set up. Patching to the fixed release is the only real fix.
Check your access.log for unfamiliar usernames or unexpected requests. If you find anything that looks like an intrusion, Cisco recommends re-imaging rather than trusting a system patched in place.
CVE-2026-76460 is about as bad as it gets for identity infrastructure: no login needed, root-level impact, no workaround, and confirmed active exploitation before the public even had a KEV entry to check. If you run Cisco ISE, the version table above is the only thing that matters right now. Patch first, investigate second, and don’t assume your configuration was ever going to save you, because on this one, it wasn’t going to.
Categories
Related articles
