CVE-2026-76460: Cisco ISE Flaw Actively Exploited

CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypasses authentication without requiring user interaction, it opens the door to severe compromise across affected network infrastructure.

With active exploitation already underway and a maximum severity score, security teams must act quickly to safeguard their environments. Below, we break down what makes this vulnerability so dangerous, which versions are impacted, and the essential steps needed to remediate and hunt for potential compromises.

What Is CVE-2026-76460?

CVE-2026-76460 (CVSS 10.0) is an unauthenticated authentication bypass in an API used by Cisco ISE. Cisco classifies the weakness as CWE-648: Incorrect Use of Privileged APIs.

The vulnerability stems from insufficient authentication controls on an API endpoint. A remote attacker can send a crafted request to bypass the web-based management interface and gain unauthorized access to the device.

Cisco has not publicly disclosed the vulnerable API endpoint, request format, or complete exploit chain.

The vulnerability has a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reflecting network-based exploitation, low attack complexity, no required privileges or user interaction, and potentially high confidentiality, integrity, and availability impact.

Which Cisco ISE Versions Are Affected?

CVE-2026-76460 affects Cisco ISE and ISE-PIC regardless of device configuration. The first fixed releases are:

Cisco ISE 3.0 has reached the End of Software Maintenance. Organizations still using it should migrate to a supported release containing the fix.

For distributed deployments, administrators must assess and patch every node, rather than assuming an update to the primary node protects the entire environment.

Why Is CVE-2026-76460 Critical?

The vulnerable API is associated with the ISE management plane. After bypassing authentication, an attacker may gain privileged access and ultimately execute commands with root privileges.

This level of access could expose or alter configuration and identity-related data and allow further activity from the appliance. It also creates an incident-response challenge because an attacker with root access may remove or conceal local evidence.

As a result, defenders should correlate appliance records with external firewall and network telemetry instead of relying solely on logs stored on an affected node.

Is CVE-2026-76460 Actively Exploited?

Yes. Cisco PSIRT is aware of active exploitation and strongly recommends upgrading to a fixed release. The vulnerability was identified while resolving a Cisco Technical Assistance Center (TAC) support case. CISA also added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, requiring U.S. federal civilian agencies to remediate it by September 19.

The attacks have not been publicly attributed to a specific threat actor, and the number of compromised organizations remains unknown. No independently verified public proof-of-concept exploit was identified at the time of writing.

To stay ahead of critical threats like CVE-2026-76460, you can leverage SOCRadar Cyber Threat Intelligence (CTI) module for real-time tracking of active exploitation, actionable remediation guidance, and tailored threat intelligence. Paired with the Attack Surface Management (ASM) module, your security team gains instant visibility to automatically discover exposed Cisco ISE assets across their digital footprint and prioritize swift defense before attackers exploit them.

What Should Defenders Do About CVE-2026-76460?

Patch Every ISE and ISE-PIC Node

Organizations should identify the exact version and patch level of each ISE and ISE-PIC node and upgrade to the appropriate fixed release.

Cisco states that no workaround addresses CVE-2026-76460. As a temporary mitigation, infrastructure access control lists (iACLs) can restrict traffic so that only required management and control-plane connections reach affected devices. This can reduce exposure but does not replace patching.

Administrators should consult Cisco’s security advisory for CVE-2026-76460 for current remediation and investigation guidance.

Hunt for Signs of Exploitation

Cisco recommends reviewing access.log for suspicious usernames on every node. API gateway access logs can also be collected through an ISE support bundle.

Defenders should correlate these records with firewall and network telemetry and investigate:

• Unexpected administrative or API activity
• Suspicious configuration changes
• Unexplained uploads from ISE systems
• Downloads from unexpected or malicious external IP addresses
• Signs that local logging or other services were modified

Because root-level access may allow attackers to alter local evidence, clean appliance logs alone should not be treated as proof that exploitation did not occur.

Re-Image Systems When Compromise Is Suspected

If malicious activity is suspected, Cisco strongly recommends re-imaging affected nodes and restoring from a configuration backup if necessary.

Teams should preserve available evidence before recovery, investigate activity surrounding the suspected exploitation period, and confirm that every node in a distributed deployment has been assessed.

For affected environments, the priority is therefore twofold: apply the appropriate fixed release and determine whether exploitation occurred before remediation. Patching closes the known vulnerability but does not rule out an earlier compromise.