Cisco ISE Zero-Day CVE-2026-76460: One Unguarded API Call Gets Root, No Workaround

Cisco published an emergency advisory on 16 September 2026 for CVE-2026-76460, an authentication bypass in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). The bug scores a maximum CVSS 10.0, needs no credentials and no user interaction, and Cisco's Product Security Incident Response Team says it is already being exploited. CISA added it to the Known Exploited Vulnerabilities catalog the same afternoon with a three-day remediation deadline of 19 September. There is no workaround. ISE is the appliance that decides which users and devices are allowed onto most enterprise Cisco networks, so an unauthenticated root path into it is about as bad as a network-infrastructure bug gets.

What Happened

Advisory cisco-sa-ISE-ABP-VNSW7Tn5 (version 1.0, marked final) went out at 16:00 GMT on 16 September. Cisco describes the flaw as "insufficient authentication control on an API endpoint": an attacker sends a crafted request straight to the affected endpoint and bypasses the web-based management interface entirely. The advisory's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with the changed-scope flag reflecting that a foothold on ISE reaches well beyond the appliance itself. The weakness is classified as CWE-648, incorrect use of privileged APIs, and tracked internally as Cisco bug CSCww39530.

Two details in the advisory stand out. First, the exploitation statement is unambiguous: "The Cisco PSIRT is aware of active exploitation of this vulnerability." Second, the source line credits no researcher. Cisco says the vulnerability "was found during the resolution of a Cisco Technical Assistance Center (TAC) support case," which is the signature of a bug that surfaced during an investigation rather than one reported ahead of attackers.

CISA's KEV feed (catalog version 2026.09.16) records the entry as "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability," added 16 September with a due date of 19 September under BOD 26-04. The ransomware-use field is currently "Unknown." NVD published the record at 21:17 UTC the same day and carries Cisco's 10.0 score as the CNA assessment.

The disclosure arrived two days after Cisco's other exploited zero-day this week, covered here in Cisco Email Gateway Zero-Day CVE-2026-76461: A Crafted Email Gets Root; CISA Gives 3 Days. Two maximum-severity, in-the-wild Cisco bugs in one week is not a coincidence worth ignoring when you plan your patch windows.

Who Is Affected

Every ISE and ISE-PIC deployment is affected "regardless of configuration," per Cisco. The fixed-software table covers releases 3.1 through 3.5; release 3.0 has reached end of maintenance and Cisco's guidance for it and anything earlier is to migrate to a fixed release. NVD's affected-product list enumerates ISE 3.1.0 through 3.5.0 across their existing patch levels, and ISE-PIC 3.4.0 and 3.5.0.

The first fixed releases are:

• ISE / ISE-PIC 3.1 Patch 12
• ISE / ISE-PIC 3.2 Patch 11
• ISE / ISE-PIC 3.3 Patch 12
• ISE / ISE-PIC 3.4 Patch 7
• ISE / ISE-PIC 3.5 Patch 4

Note that the same patch set also closes two other Cisco ISE advisories published the same day. The hardening release cisco-sa-hardening-ise-XU5EwX5T bundles six CVEs from Cisco's internal review, two of them scored 10.0 (CVE-2026-20130, an injection flaw, and CVE-2026-20192, an access-control bypass), and cisco-sa-ise-multi-hrP9jQSQ, credited to Li Jiantao and Tevel Sho of STAR Labs SG, fixes six more including CVE-2026-76423, a CVSS 10.0 REST API authentication bypass that hands an unauthenticated attacker administrative access. Cisco says it is not aware of exploitation of any of those twelve. But for the multi-vulnerability advisory, releases 3.1 and 3.2 only receive the fix for CVE-2026-76423; the rest require migration to 3.3 or later. If you are still on 3.1 or 3.2, this week is the argument for moving.

Technical Analysis

The mechanism is simple, which is why it is dangerous. ISE fronts its management functions with a web interface that enforces login, but the appliance also exposes API endpoints that the interface and other components call. One of those endpoints did not enforce authentication properly. The web login page is irrelevant if a client can talk to the privileged endpoint behind it directly. Why a Missing Auth Check on One API Endpoint Bypasses the Whole Login Page walks through that pattern and why it recurs across appliances.

Cisco's indicators-of-compromise section confirms the depth of access. It states plainly that a successful attacker obtains "command-and-control capabilities with root privileges" on the node, and that because of this they "may hide or delete evidence" of the intrusion. The detection guidance reflects that: search the API gateway access log on every node for suspicious usernames. The advisory's example command is:

admin#show logging application ise-kong/access.log | include dummyuser

Cisco says "the presence of any entry in the output may indicate malicious activity." For distributed deployments, check every node, not just the primary admin node; the same log is available in support bundles at ./ise/logs/apigateway/access.log..gz. Because logs on the box may have been altered, Cisco also tells administrators to correlate with telemetry that lives off the appliance: firewall and proxy logs showing unexpected uploads to external IPs, or downloads from unknown sources, by the ISE nodes.

Consider what root on ISE gives an attacker. ISE holds the network's access policy, the device-administration configuration for switches and routers, the shared secrets it uses with network devices, and typically a machine account in Active Directory. Modifying policy lets an intruder grant their own devices full access to any segment ISE controls; harvesting secrets lets them authenticate as the infrastructure. Why a Compromised Network Access Control Server Outranks a Compromised Firewall lays out that blast radius in detail.

Immediate Actions

1. Patch every node to the first fixed release for your train. This is the only fix. Cisco says outright: "There are no workarounds that address this vulnerability." Release 3.0 and earlier must migrate.
2. Apply the mitigation while you schedule the patch. Cisco recommends infrastructure access control lists (iACLs) that allow only required management and control-plane traffic to reach the ISE nodes. This blocks remote exploitation from untrusted sources but does not remove the bug; treat it as a stopgap. How to Restrict a Web Admin Interface to Trusted IP Addresses covers the general approach, and How to Inventory and Lock Down the API Surfaces on Your Network Appliances explains why the API paths, not just the login page, need to be in scope.
3. Hunt before you assume you are clean. Run the access-log search above on every node. Then pull firewall, proxy, and DNS records for the ISE nodes' addresses and look for outbound connections that ISE has no business making.
4. If you find anything, rebuild. Cisco's language is strong: "it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed." Root access plus log tampering means a patched but previously compromised node cannot be trusted. Rotate the secrets ISE held, including RADIUS and TACACS+ shared secrets, the AD join account, and admin credentials.
5. Take the other two ISE advisories seriously. They ship in the same patches, so patching for CVE-2026-76460 closes them at the same time; the exception is 3.1 and 3.2, which only get partial coverage.

Long-Term Outlook

ISE has been here before. In July 2025, CVE-2025-20337, another maximum-severity ISE flaw, was exploited as a zero-day and attackers dropped a web shell named IdentityAuditAction on compromised appliances, according to BleepingComputer's reporting. The same outlet counts 99 Cisco product vulnerabilities tagged as actively exploited by CISA over the past five years, seven of them used in ransomware.

The pattern across those incidents is consistent: appliances that concentrate authority over the network are found reachable from places they should not be, and a single missing check turns into full control. The structural defence is to treat identity and policy servers as the most privileged infrastructure you own. Put them behind strict management-plane controls, log their API traffic somewhere the appliance cannot edit, and keep a rehearsed rebuild procedure ready. The KEV deadline is three days; the assumption that the appliance might already be compromised should last longer than that.

Sources

• Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
• Cisco Security Advisory cisco-sa-hardening-ise-XU5EwX5T: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ise-XU5EwX5T
• Cisco Security Advisory cisco-sa-ise-multi-hrP9jQSQ: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ
• CISA Known Exploited Vulnerabilities feed (catalog 2026.09.16): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA alert, 16 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
• NVD CVE-2026-76460: https://nvd.nist.gov/vuln/detail/CVE-2026-76460
• BleepingComputer, Sergiu Gatlan, 17 September 2026: https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/
• SecurityWeek, Ionut Arghire, 17 September 2026: https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/
• Help Net Security, Zeljka Zorz, 17 September 2026: https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/