Cisco has published an alert about a critical vulnerability, CVE-2026-76460 (CVSS 10.0), in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which, according to Cisco PSIRT, is already being exploited in real-world attacks. The vulnerability allows an unauthenticated remote attacker to bypass authentication on an API endpoint and gain unauthorized access to the web management interface, and, if exploitation is successful, to execute commands with root privileges. There are no workarounds: the only complete mitigation is to install the patch. CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on 16 September 2026, with a remediation deadline for US federal agencies of 19 September 2026. The vulnerability affects all configurations of ISE and ISE-PIC from versions 3.1 through 3.5.
Technical details of the vulnerability
According to the official Cisco advisory, the root cause is insufficient authentication enforcement on an API endpoint. The attacker sends a specially crafted request to the vulnerable endpoint and as a result gains access to the ISE web management interface without passing authentication. Cisco assigned the vulnerability CWE-648 classification and the maximum CVSS score of 10.0.
The key point Cisco emphasizes is that upon successful exploitation the attacker gains the ability to execute commands with root privileges. This means full control over the device, including the ability to delete or hide traces of the compromise.
Affected versions and corresponding patches:
- ISE/ISE-PIC 3.1 — fixed in 3.1 Patch 12
- ISE/ISE-PIC 3.2 — fixed in 3.2 Patch 11
- ISE/ISE-PIC 3.3 — fixed in 3.3 Patch 12
- ISE/ISE-PIC 3.4 — fixed in 3.4 Patch 7
- ISE/ISE-PIC 3.5 — fixed in 3.5 Patch 4
The vulnerability affects ISE and ISE-PIC regardless of device configuration — this significantly broadens the attack surface, since there is no configuration parameter that would reduce the risk.
Detecting compromise: why local logs are not enough
Cisco recommends checking the access.log file for suspicious usernames using the following command:
admin#show logging application ise-kong/access.log | include dummyuser
The presence of any entries in the output of this command is highly likely to indicate malicious activity. If such entries are found, Cisco recommends reinstalling the image of affected nodes and restoring the configuration from backup.
However, this creates a significant detection challenge that should be taken into account during incident response. Cisco explicitly warns that attackers who obtain root privileges can delete or hide indicators of compromise on the device itself. This means that a cleanaccess.log file is not sufficient grounds to conclude that there has been no compromise. In distributed ISE deployments, it is necessary to check the logs of every node and also correlate data with external sources — logs from network equipment, firewalls, and monitoring systems that are outside the attacker’s control on a compromised ISE node.
Scope of the September update and prioritization
CVE-2026-76460 was disclosed as part of a large Cisco security update on 16 September 2026. According to the source material, 77 new CVEs were published on the same day, 41 of which affect ISE and 28 the Secure Firewall product line. These figures are supported only by a secondary source and are not directly confirmed by Cisco in public advisories.
Among other disclosed ISE vulnerabilities there are several groups with critical CVSS ratings:
- CVE-2026-76423 (CVSS 10.0) and related CVE-2026-76424 — CVE-2026-76428 — authentication bypass in the REST API, remote code execution, SQL injection, and XXE attacks
- CVE-2026-20176 (CVSS 9.9), CVE-2026-20211, and CVE-2026-20307 — remote operating system command execution (administrative credentials required)
- CVE-2026-20130 and CVE-2026-20192 (both CVSS 10.0) — authentication and authorization bypass, command injection
The fundamental difference between CVE-2026-76460 and most of the other disclosed ISE vulnerabilities is that it does not require authentication. Many of the accompanying critical vulnerabilities (for example, the CVE-2026-20176/20211/20307 group) assume that the attacker already has valid administrative credentials. CVE-2026-76460 has no such restriction, which, combined with confirmed active exploitation and inclusion in CISA KEV, makes it an absolute priority for immediate patching.
It is important to note that the product coverage differs between vulnerability groups. CVE-2026-76460 affects both ISE and ISE-PIC regardless of configuration. The CVE-2026-76423 — CVE-2026-76428 group has mixed coverage: some vulnerabilities affect both products, others only ISE. The RCE vulnerability group (CVE-2026-20176 and others) affects ISE but not ISE-PIC. When planning patching, you must refer to the specific advisories for each group.
It is also worth noting that Cisco uses grouped CVSS scores for “hardening” releases, where the stated score reflects the maximum potential severity of the most critical vulnerability within a CWE group, rather than the score for each individual vulnerability in the group.
Relation to other actively exploited Cisco vulnerabilities
The disclosure of CVE-2026-76460 came a few days after Cisco reported active exploitation of CVE-2026-76461 (CVSS 9.8), a critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway. We have already analyzed this vulnerability in the article CVE-2026-76461: SQL injection in Cisco Secure Email Gateway. Earlier in September, Cisco also disclosed critical vulnerabilities in Nexus 9000 and IOS XR, which we covered previously. Taken together, these events point to an intensive period of critical vulnerability disclosures in Cisco products.
No information is available on attribution of the attacks exploiting CVE-2026-76460: Cisco has not disclosed the nature of the attacks, the threat actors behind them, or the scale of the campaign.
Response recommendations
- Immediately install the patch to the versions specified in the Cisco advisory. There are no workarounds.
- Until the patch is installed, restrict access to the ISE management interface using infrastructure access control lists (iACL), allowing only necessary management and control-plane traffic.
- Check all nodes in the distributed ISE deployment for indicators of compromise using the specified command to analyze
access.log. - Correlate with external logs — firewall, network equipment, and SIEM logs, since root access allows the attacker to hide traces on the device itself.
- If compromise is detected, reinstall the image on affected nodes and restore the configuration from backup.
CVE-2026-76460 is a rare case where a maximum CVSS score, an unauthenticated attack vector, confirmed active exploitation, and the absence of workarounds all coincide. Organizations using Cisco ISE or ISE-PIC of any version from 3.1 to 3.5 should treat installation of the corresponding patch as a top-priority task and in parallel conduct retrospective log analysis to rule out an already completed compromise.
