Executive Summary
CVE-2026-76460 is a critical authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Cisco assigns it a CVSS 3.1 score of 10.0 and says an unauthenticated remote attacker can send a crafted request to an affected API endpoint and bypass the web-based management interface.
This is not merely a theoretical maximum-severity vulnerability. Cisco PSIRT has confirmed active exploitation, and CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog on September 16, 2026.
The strategic importance comes from where ISE sits in enterprise architecture. ISE participates in identity-driven network access, authentication, authorization and policy enforcement. An authentication boundary failure in such a system is therefore considerably more interesting than compromise of an ordinary web application.
For offensive-security practitioners, the lesson is simple: identity infrastructure belongs in the external and internal attack-surface model.
Vulnerability Snapshot
| Field | Verified Information |
|---|---|
| CVE | CVE-2026-76460 |
| Product | Cisco ISE / ISE-PIC |
| Class | Authentication bypass / CWE-648 |
| CVSS 3.1 | 10.0 Critical |
| Attack Vector | Network |
| Authentication | None |
| User Interaction | None |
| Exploitation | Confirmed |
| CISA KEV | Yes — September 16, 2026 |
| Workaround | None |
| Patch | Available |
Cisco describes the underlying problem as insufficient authentication control on an API endpoint.
What Is Vulnerable?
Cisco ISE is not simply another administrative application.
It is commonly positioned at the intersection of network access and identity. Organizations use ISE for functions including network-access policy, device administration, authentication and authorization.
That position changes the security value of the vulnerability.
An attacker who compromises a random application server may gain access to one application. An attacker who compromises infrastructure involved in determining who or what receives network access has reached a much more strategically useful trust boundary.
Cisco states that ISE and ISE-PIC are affected regardless of device configuration. Supported release trains have fixed patches, while organizations remaining on ISE 3.0 must migrate because that release has reached End of Software Maintenance.
Technical Analysis
Public technical detail remains limited.
Cisco says the vulnerability exists because an API endpoint does not enforce authentication correctly. A crafted request can reach functionality that should have been protected by the management authentication boundary.
That distinction matters.
The flaw is not a stolen-password problem. It is not credential stuffing. It is not MFA fatigue.
The application itself incorrectly decides that a request is authorized to cross an authentication boundary.
The CVSS vector reflects that:
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In practical terms:
- exploitation can occur over a network;
- attack complexity is low;
- no existing privileges are required;
- no user interaction is required;
- successful exploitation can have severe confidentiality, integrity and availability consequences.
Cisco has not publicly documented enough of the request-processing internals to justify inventing a detailed exploit path.
That limitation should be preserved.
Attacker’s Perspective
From an offensive-security perspective, the interesting part is not simply “authentication bypass.”
It is authentication bypass against an identity-policy system.
Cisco describes unauthorized access through the web management authentication bypass and also warns that successful exploitation may lead to command execution with root privileges. That possibility makes external telemetry and investigation of prior compromise especially important.
From there, additional possibilities depend heavily on the deployment.
A compromised ISE environment could potentially expose security-policy information, network topology clues, identity relationships and configuration information useful for subsequent operations. Those are logical post-compromise objectives, not confirmed consequences of observed attacks.
Conceptual Attack Path
This is a hypothetical methodology scenario, not a claim about observed exploitation:
Internet or reachable management network
↓
Cisco ISE API endpoint
↓
CVE-2026-76460 authentication bypass
↓
Unauthorized management access
↓
Identity and policy infrastructure exposed
↓
Configuration and trust relationship discovery
↓
Potential expansion into internal infrastructure
The important methodological point is that compromising the enforcement infrastructure may provide more leverage than compromising an individual endpoint.
Why This Matters for Offensive Security
Traditional perimeter enumeration often concentrates on VPN gateways, web applications, firewalls and exposed remote-management services.
Identity infrastructure deserves the same attention.
During an authorized assessment, testers should identify:
- exposed NAC infrastructure;
- management interfaces;
- API endpoints;
- identity providers;
- RADIUS and TACACS+ relationships;
- administrative trust relationships;
- certificate infrastructure;
- network-device integrations.
ISE also demonstrates why asset classification matters.
A CVSS 10 application server and a CVSS 10 identity-policy engine do not necessarily have equivalent strategic value.
The latter can sit much closer to the organization’s security control plane.
Defender Detection
Cisco has provided a useful starting point for hunting.
Administrators should examine the ISE API gateway access.log for suspicious usernames. Cisco documentation and subsequent guidance identify suspicious API activity as a potential indicator and recommend checking every node in distributed deployments.
Detection should extend beyond the appliance itself.
Review:
- API gateway access logs;
- administrative login history;
- unexpected configuration changes;
- newly created administrative identities;
- policy modifications;
- unusual outbound connections;
- authentication activity from unexpected sources.
Because successful compromise may provide significant access, external SIEM and network telemetry should be preferred over relying exclusively on logs stored on the affected system.
Mitigation
There is no workaround that replaces patching.
Cisco’s first fixed releases are:
| Release | First Fixed Release |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
ISE 3.0 users should migrate to a supported release.
Organizations should additionally restrict management interfaces to trusted administrative networks and investigate vulnerable systems for prior compromise rather than assuming patch installation erases earlier attacker access.
Broader Security Lesson
Security controls are software.
They contain APIs, parsers, authentication logic and management interfaces just like the applications they protect.
That makes security infrastructure itself part of the attack surface.
The deeper lesson from CVE-2026-76460 is therefore architectural:
systems responsible for enforcing trust must themselves be treated as high-value targets.
An organization can have excellent endpoint protection while remaining exposed through the systems that decide which endpoints, identities and administrators are trusted.
Key Takeaways
- CVE-2026-76460 is a verified CVSS 10 authentication bypass.
- Cisco has confirmed active exploitation.
- CISA added the vulnerability to KEV on September 16.
- No workaround replaces installation of Cisco’s fixed releases.
- Identity and NAC infrastructure should be explicitly included in attack-surface reviews.
- A compromised security-control system can provide attackers leverage well beyond the appliance itself.
References
- Cisco — Cisco Identity Services Engine Authentication Bypass Vulnerability, September 16, 2026. Cisco Security Advisory
- Canadian Centre for Cyber Security — Vulnerabilities Impacting Cisco ISE and ISE-PIC, September 2026. Canadian Cyber Centre Alert
- CISA — Known Exploited Vulnerabilities Catalog. CISA KEV entry for CVE-2026-76460
Red Brixen Research Notes
Research Confidence: High
Confirmed Exploitation: Yes
Public PoC: Not relied upon for this analysis
CISA KEV: Yes
Primary Sources Consulted: Cisco PSIRT, CISA-derived KEV data, Canadian Centre for Cyber Security
Last Verified: September 25, 2026