Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

1. Executive summary

Cisco has disclosed CVE-2026-76460, an authentication bypass in an API of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), and confirmed it is under active exploitation. Per our verified reference data the flaw is CVSS 10.0 (CRITICAL), classified CWE-648 (Incorrect Use of Privileged APIs), and was added to CISA KEV on 2026-09-16; the KEV entry records a remediation due date of 2026-09-19. A remote, unauthenticated attacker can bypass the web-based management interface with a crafted request and, per Cisco as reported, obtain command execution with root privileges — which allows removal or concealment of the appliance's own logs. For EMEA financial services this is a control-plane compromise, not a perimeter nuisance: ISE is the identity-based network access control and policy platform that decides who and what gets on the network, so a successful bypass undermines both network segmentation and the audit trail used to prove it. No workaround exists; remediation is a patch plus, where exploitation is suspected, node re-imaging and configuration restore from backup.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17 — ICT-related incident management process	Cisco states there is no workaround and directs that affected nodes be re-imaged and restored from configuration backup if exploitation is suspected; root-level access lets an attacker delete the appliance's own logs.	The incident-management process must support node re-image + config restore as a remediation path, and must not treat log-cleaning as remediation. Evidence collection has to run out-of-band (network/firewall telemetry held off the ISE device).
DORA Art. 18 — classification of ICT-related incidents and cyber threats	Confirmed in-the-wild exploitation (CISA KEV, added 2026-09-16) of an authentication bypass in the platform that enforces network access control and generates the access logs normally used for impact assessment.	Impact classification cannot rely on ISE's own `access.log`; classify on the basis of external network/firewall evidence and assume the affected node's logging may be incomplete or tampered with.
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities	Confirmed exploitation on any ISE or ISE-PIC node is an ICT-related incident affecting a security control plane; the KEV entry sets a remediation due date of 2026-09-19.	If exploitation is confirmed, start the reporting clock and preserve evidence before re-imaging.

No other article in the regulatory reference passes the distinctiveness test for this item on the facts available.

3. Technical analysis & attack chain

Confirmed attack chain (per Cisco PSIRT as reported by The Register and Help Net Security)

The attacker identifies a reachable Cisco ISE or ISE-PIC node running a vulnerable release (3.0 through 3.5). Cisco states vulnerable versions are affected regardless of configuration.
The attacker sends a crafted request to an API endpoint exposed by the product's web-based management interface. No credentials and no user interaction are required.
The request bypasses authentication on that endpoint, giving the attacker unauthorized access to the affected device by circumventing the web-based management interface.
Post-access, the attacker can obtain command execution with root privileges on the underlying operating system (Cisco, as reported by The Register).
With root, the attacker can remove or conceal traces of the intrusion — Cisco explicitly warns this complicates determining whether an appliance was breached.

Vulnerability mechanism and classification discrepancy. Our verified reference data classifies CVE-2026-76460 as CWE-648 (Incorrect Use of Privileged APIs), and the CISA/NVD description frames it as an "incorrect use of privileged APIs" vulnerability. Cisco's own wording, as quoted in the source material, describes it as "insufficient authentication control on an API endpoint" — a description closer to CWE-306 (Missing Authentication for Critical Function). Both descriptions can describe the same flaw: an API endpoint that performs privileged operations without adequately enforcing authentication on the caller. We use the verified CWE-648 classification; note the discrepancy rather than treating the two as competing claims.

Affected and fixed versions.

Affected: Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), releases 3.0 through 3.5.
Fixed: ISE / ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4.
ISE 3.0 has reached end of software maintenance and must be migrated. Releases 3.1 and 3.2 receive only critical fixes; Cisco advises migrating to supported releases 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4.
No workaround exists. Cisco notes infrastructure access control lists can be used as a temporary mitigation to restrict management and control-plane traffic reaching affected systems.

Detection guidance from the vendor. Review access.log and look for suspicious usernames; this must be done on every node in a distributed deployment. Because attackers may delete the solution's logs, Cisco advises cross-checking network and firewall logs held outside the impacted device for unexpected uploads initiated from the affected device to external IP addresses, or downloads from malicious IP addresses. If malicious activity is suspected, Cisco "strongly recommends" re-imaging affected nodes and restoring configurations from backup if necessary.

Attribution and post-exploitation: unconfirmed. Cisco discovered CVE-2026-76460 while resolving a Technical Assistance Center support case. Cisco has not disclosed who is exploiting it, how long the attacks have been underway, or what intruders have done after gaining access. There is no MITRE ATT&CK actor profile in our verified reference data for this activity, so no attribution is made and none should be inferred. Treat any actor claim circulating elsewhere as unconfirmed.

Related Cisco activity (context only — outside our verified reference data). The source material places this in a wider September Cisco patching cycle:

CVE-2026-76461 — actively exploited flaw in Cisco Secure Email Gateway and Secure Email and Web Manager, rated 9.8 by the source, also capable of root access; Cisco warned attackers may be able to cover their tracks. Severity is the source's figure; this CVE is not in our verified reference data and we do not re-assess it here.
CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management authentication bypass using an alternate path or channel, allowing an unauthenticated remote attacker to bypass authentication and execute script files to obtain root. This appears as a separate CISA KEV entry with a due date of 2026-09-12. Also outside our verified reference data.
The same Cisco advisory batch included two further advisories carrying maximum 10.0 scores and a trio of remote code execution flaws scoring as high as 9.9 (per The Register). Single-sourced; verify against Cisco's advisory set before scoping.

4. Mitigation & containment

P1 — within 24 hours

Inventory and exposure check. Enumerate every ISE and ISE-PIC node, including all nodes in distributed deployments, and record the running release. Any node on 3.0–3.5 is in scope. Prioritise nodes whose management interface is reachable from anything other than a hardened administrative segment.
Apply the vendor fix. Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. There is no workaround — patching is the only remediation. Given the KEV remediation due date of 2026-09-19, this is a 48-hour action, not a next-change-window action.
Interim network restriction. Where patching cannot be completed immediately, apply infrastructure access control lists to restrict management and control-plane traffic reaching affected systems, per Cisco's temporary mitigation. This is a stopgap, not a fix.
Hunt for exploitation now. On every node, review access.log for suspicious usernames. In parallel, pull network and firewall logs from outside the ISE device and look for unexpected uploads from the ISE node to external IP addresses and downloads from malicious IP addresses. Do not rely on the ISE node's own logs alone — root-level access permits log deletion.
Preserve evidence before remediation. If exploitation is suspected, capture external telemetry and node state before re-imaging. Re-imaging destroys the evidence you will need for incident classification and any regulatory report.

P2 — within 72 hours

Re-image where indicated. For any node with evidence of possible exploitation, re-image the node and restore configuration from backup, per Cisco's strong recommendation. Do not attempt to clean a compromised node in place.
Migrate off unsupported releases. ISE 3.0 is out of software maintenance; 3.1 and 3.2 receive critical fixes only. Plan migration to 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4.
Review administrative exposure. Confirm management interfaces are not internet-reachable and that control-plane access is restricted to jump hosts with MFA. The vulnerability requires no credentials, so network reachability is the only precondition an attacker needs.
Check log-forwarding integrity. Verify ISE logs are shipped off-box in near-real-time to a SIEM or log store the attacker cannot reach from the ISE node, and confirm there are no unexplained gaps in the forwarding timeline.

P3 — within 7 days

Sweep the wider Cisco estate. Given the concurrent CVE-2026-76461 (Secure Email Gateway / Secure Email and Web Manager) and CVE-2026-20079 (FMC / SCC Firewall Management) activity, confirm patching status for those products against Cisco's advisories. These CVEs are outside our verified reference data — verify severity and fixed versions directly with Cisco.
Update the IR playbook. Add the re-image-and-restore-from-backup path for ISE nodes and the out-of-band evidence-collection requirement, so the next occurrence does not stall on "how do we remediate an appliance we cannot trust."

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. Cisco has published behavioural detection guidance rather than atomic indicators; those behaviours are captured below.

Behavioural indicators

Behaviour	Where to observe	Confidence
Suspicious usernames appearing in ISE access logs	`access.log` on every node in the deployment	High — Cisco advisory, reported by Help Net Security and The Register
Unexpected uploads initiated from the affected ISE device to external IP addresses	Network and firewall logs held outside the impacted device	Medium — Cisco advisory; no atomic values published
Downloads from malicious IP addresses to the affected ISE device	Network and firewall logs held outside the impacted device	Medium — Cisco advisory; no atomic values published
Removal or concealment of ISE logs following root-level access	ISE node logging and SIEM/log-forwarding continuity	Medium — Cisco warning as reported by The Register; no observed sample published

No copyable atomic-indicator block is provided because the sources contain no hashes, domains, IP addresses, file paths or filenames attributable to this activity.

6. Detection

Insufficient indicators to author detection rules.

The source material provides no threat artefacts — no hashes, filenames, mutexes, command-line flags, registry keys or network values — only vendor behavioural guidance. Detection for this item should be built from the behavioural indicators in §5: alert on anomalous usernames in ISE access.log, on outbound transfers from ISE nodes to external addresses observed in off-box firewall/network telemetry, and on gaps in ISE log forwarding.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-76460	10.0 Critical	⚠ KEV 2026-09-16	—	A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass aut…

7. Sources

Help Net Security — Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460) — https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/ — 2026-09-17
The Register — Cisco drops another exploited zero-day, this time a perfect 10 — https://www.theregister.com/security/2026/09/17/cisco-drops-another-exploited-zero-day-this-time-a-perfect-10/5297180 — 2026-09-17
CISA Known Exploited Vulnerabilities / NVD — CVE-2026-76460 — Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-76460
CISA Known Exploited Vulnerabilities / NVD — CVE-2026-20079 — Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management Authentication Bypass — https://nvd.nist.gov/vuln/detail/CVE-2026-20079
SecurityWeek — Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day — https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/
SecurityWeek — Critical Command Execution Vulnerability Patched in Cisco ISE — https://www.securityweek.com/critical-command-execution-vulnerability-patched-in-cisco-ise/
BSI Germany (WID) — Cisco ISE und ISE-PIC: Mehrere Schwachstellen — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3425

8. Adverse Trace position

We assess CVE-2026-76460 as CVSS 10.0 (CRITICAL), CWE-648, and confirmed exploited in the wild (CISA KEV, added 2026-09-16), with a KEV remediation due date of 2026-09-19. The combination of unauthenticated remote exploitation, no workaround, root-level post-exploitation access, and the target being the network access control plane makes this a genuine P1 for any EMEA financial services client running Cisco ISE or ISE-PIC — the attacker does not merely read data, they can grant themselves network access and then erase the record of having done so. Client impact is highest for firms using ISE as a segmentation or zero-trust enforcement point, where a bypass invalidates assumptions about which network segments are actually isolated. Confidence caveats: the root-privilege and log-concealment claims rest on Cisco's advisory as reported by The Register, and the wider Cisco CVE set referenced in §3 (CVE-2026-76461, CVE-2026-20079, the additional 10.0 and 9.9 advisories) is single-sourced and outside our verified reference data — verify against Cisco's own advisories before scoping remediation. No attribution is made; Cisco has not disclosed the actor, the duration of exploitation, or post-exploitation activity, and there is no MITRE ATT&CK profile for this activity in our reference data. Next: we will track Cisco's advisory updates and any further KEV additions in this September Cisco cycle, and will re-issue if fixed-version guidance or observed post-exploitation detail changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.