Cisco patches actively exploited authentication bypass in ISE and ISE-PIC
Cisco has released fixes for a critical authentication bypass affecting Identity Services Engine and ISE Passive Identity Connector after confirming that the vulnerability is being actively exploited.
The company disclosed CVE-2026-76460 on 16 September 2026 and assigned it the maximum CVSS 3.1 score of 10.0. The vulnerability affects Cisco ISE and ISE-PIC regardless of device configuration, according to the vendor’s advisory.
Cisco said its Product Security Incident Response Team was aware of active exploitation. The company found the vulnerability while resolving a Technical Assistance Center support case, but its public advisory does not identify an attacker, campaign, victim or targeted sector. It also does not disclose when exploitation began.
The distinction matters because the available evidence confirms exploitation, but does not establish that attacks began before fixes were available. Public sources also do not confirm data theft, an outage or a breach at any named organisation.
Which Cisco ISE releases are fixed?
The flaw stems from insufficient authentication control on an ISE API endpoint. Cisco said an unauthenticated remote attacker could send a crafted request, bypass the web management interface and obtain unauthorised access to an affected device. Successful exploitation may lead to command execution with root privileges, which could allow an attacker to conceal or remove evidence from the appliance.
Cisco lists the following as the first fixed releases for both ISE and ISE-PIC:
3.1 Patch 12
3.2 Patch 11
3.3 Patch 12
3.4 Patch 7
3.5 Patch 4
Deployments running an earlier patch in any of those release trains remain affected. Cisco directs customers using version 3.0 to migrate to a supported fixed release because 3.0 has reached the end of software maintenance.
The affected status applies regardless of configuration. Segmentation and restricted management access may reduce practical exposure, but they do not remove the vulnerable code or make an affected release fixed.
CVE-2026-76460 was disclosed as part of a wider group of Cisco ISE security advisories published on 16 September. That group included other critical and high-severity issues, but Cisco’s confirmation of active exploitation applies specifically to CVE-2026-76460 and should not be extended to the entire batch.
No workaround does not mean no temporary mitigation
Cisco says there is no workaround for the vulnerability, but it does document a temporary infrastructure access control list, or iACL, mitigation. The measure limits traffic destined for the affected device to required management and control-plane communications.
That access restriction is a compensating control rather than a substitute for the fixed software. Its effectiveness depends on how it is implemented and on the traffic a deployment legitimately requires. It can narrow access while an upgrade is arranged, but the vulnerable software remains present until the appropriate fixed release is installed.
The Canadian Centre for Cyber Security has also advised organisations to install the updates immediately, restrict access and review relevant records. These measures can reduce exposure, but only the fixed releases remediate the vulnerability.
Why patching may not complete the response
Installing a fixed release remediates the flaw, but it does not establish whether a previously reachable node was exploited. Cisco’s warning about possible root-level command execution means administrators should treat investigation as a separate task from software maintenance.
Cisco advises customers to review access logs on every node for suspicious usernames. It also recommends examining network and firewall records held outside the appliance. External records are important because an attacker with root privileges may have been able to remove local evidence, although the advisory does not say that every exploitation attempt obtained root access or established a lasting compromise.
A clean appliance log therefore cannot conclusively rule out malicious activity. Equally, the confirmation of active exploitation does not mean that every affected deployment was compromised. Investigation should reflect the system’s reachability and follow Cisco’s guidance, using both local and externally retained records.
Where malicious activity is suspected, Cisco recommends re-imaging affected nodes using known-good configuration backups. That step is distinct from routine patching and is intended for systems where the available evidence raises concern about compromise.
CISA deadline applied to US federal remediation
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-76460 to its Known Exploited Vulnerabilities Catalog on 16 September. It set a remediation due date of 19 September 2026 and marked forensic triage as required under Binding Operational Directive 26-04.
That date was a US federal remediation deadline, not a universal legal deadline for every Cisco customer. By the 20 September research cutoff it had already passed. Organisations outside the directive’s scope can nevertheless use the catalog entry and its triage requirement as evidence that the flaw warrants urgent prioritisation.
The public record still leaves major questions unanswered. Cisco and government advisories do not identify the actor, the number of affected organisations, the first exploitation date or any confirmed data access. For operators, the supported next step is consequently twofold: move ISE and ISE-PIC to the listed fixed releases, then assess previously exposed nodes with evidence that does not depend solely on the appliances themselves.
Patch management and evidence review answer different operational questions, especially when relevant records may exist both on and beyond an appliance. Through The Hack Academy’s online cybersecurity training programme, you can study at your own pace using practical exercises alongside theory, with networking and cybersecurity fundamentals among the listed subjects.
