Cisco Identity Services Engine API Authentication Bypass Enables Unauthenticated Root – Level Compromise CVE – 2026 – 76460
A zero-day authentication bypass tracked as CVE-2026-76460 is affecting Cisco Identity Services Engine (ISE), the platform many enterprises rely on to decide who and what is allowed onto their networks. The flaw carries a CVSS score of 10.0 out of 10, the maximum possible rating, which reflects a weakness that can be reached remotely, requires no valid credentials, and yields a complete loss of control over the affected system. ISE is not a peripheral product in most environments; it sits at the centre of network access control, issuing policy decisions for wired, wireless, and VPN sessions and holding identity data for large populations of users and devices. Any organisation running ISE as its policy enforcement backbone is potentially within scope, and that includes a substantial share of large enterprises, service providers, and public sector networks. The issue has been confirmed as exploited in the wild and was added to the CISA Known Exploited Vulnerabilities catalogue on 16 September 2026.
The weakness sits in how ISE handles authentication on an exposed API endpoint. Rather than a memory corruption bug or a complex multi-stage chain, this is a logic failure in the trust decision itself, where a request that should be rejected as unauthenticated is instead accepted and processed as if it came from a legitimate administrator. That class of flaw is attractive to attackers because it is reliable, leaves few of the crash artefacts that memory bugs generate, and can often be delivered with a single well-formed web request. Beyond that description, detailed exploitation mechanics have not been published, and our team is not going to speculate about the specific request structure or payload used in observed attacks. What is known is that the entry point is an API surface reachable over the network and that successful abuse defeats the authentication layer outright rather than escalating from a lower-privileged foothold.
The strategic problem here is what ISE controls rather than what the bug does in isolation. A system that brokers network admission decisions, stores identity and device posture information, and integrates with directory services and network infrastructure is a high-value target, because control over it can translate into the ability to authorise rogue devices, alter access policies, harvest credential material, or quietly grant an attacker a persistent path deeper into the network. Administrative interfaces for platforms like this are also frequently more exposed than teams assume, reachable from internal segments, management VLANs, or in some deployments from the internet, which widens the population of viable targets. Exploitation status is not theoretical: the vulnerability is confirmed exploited in the wild and carries a CISA KEV listing dated 16 September 2026, which places it firmly in the category of flaws attackers have already operationalised. It is worth noting the tension in the available data, as the FIRST EPSS model currently estimates only a 0.8 percent probability of exploitation activity in the next 30 days, a figure that reflects modelled likelihood across the internet at large and does not contradict the confirmed, observed attacks recorded in KEV. For defenders, the practical reading is that exploitation is real but currently appears targeted rather than indiscriminate, a pattern that frequently shifts once technical details circulate more widely.
Attack Surface
Infrastructure, System Management Service, Web Application
Tactics
Initial Access, Defense Evasion, Credential Access, Privilege Escalation
Techniques
- T1190 – Exploit Public-Facing Application
- T1068 – Exploitation for Privilege Escalation
SuperPRO's Threat Countermeasures Procedures
- Patch immediately — this is the only remediation. Upgrade Cisco ISE / ISE-PIC to the first fixed release for your train: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Cisco states there are no workarounds. Federal deadline (CISA KEV) is 19 September 2026; treat it as your target too.
- Inventory every ISE and ISE-PIC node by version and patch level; both products are affected across releases 3.1–3.5 regardless of configuration. Do not assume managed-service or appliance deployments are covered without checking.
- Until patched, restrict network reachability of the ISE administration / API interface to a dedicated management network and trusted admin hosts only; ensure it is not reachable from the internet or general user VLANs. This reduces exposure but is not a fix.
- Hunt for compromise now, before patching. Review ISE access.log for unexpected or suspicious administrative usernames and unusual API activity. Because an attacker with root can wipe or alter local logs, correlate against external/SIEM copies and network telemetry rather than trusting on-box logs alone.
- If exploitation is suspected or confirmed, re-image the affected node from a known-good build rather than patching in place — root access allows persistent backdoors that a patch will not remove — then rotate all credentials, certificates and secrets ISE stored or could access.
- Rotate ISE-adjacent secrets as a precaution: administrative credentials, RADIUS/TACACS+ shared secrets, PKI/certificates, and any directory-service (AD/LDAP) integration credentials that a compromised ISE could have exposed.
- Add detection/alerting for anomalous authentication to the ISE management plane and for changes to access policies, admin accounts, or logging configuration; forward ISE logs off-box so tampering is detectable.
