A crafted request to one Cisco ISE API endpoint reaches root without a credential
Cisco's PSIRT says CVE-2026-76460 is being exploited, and the company has published no workaround, so the fix is a branch-specific patch. ISE 3.0 is past End of Software Maintenance and gets a migration.
The Engineer · Build desk
What happened
- Cisco disclosed on September 16, 2026 that CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine, lets an unauthenticated remote attacker gain root privileges on the appliance.
- Cisco's PSIRT confirmed the flaw is being exploited in the wild, and the company says it found the defect while working a Technical Assistance Center support case.
- A crafted network request to the exposed endpoint executes commands as root without a credential, and it never passes through the web management interface.
- Affected products are Cisco ISE and ISE-PIC in all device configurations, across releases 3.1 through 3.5.
Why it matters
- What it limits constraint Cisco's guidance offers one pre-patch control: an infrastructure access control list keeping untrusted traffic away from ISE management interfaces. That is a network change.
- Who has to decide decision Anyone still running ISE 3.0 has to pick a supported branch and schedule a migration while exploitation is confirmed, and that decision cannot be made inside a patch window.
- Who's exposed exposure Root on ISE puts the attacker in charge of network admission policy for everything that trusts it, so access rules and internal subnets become reachable from an unauthenticated network position.
- Who's exposed exposure Because the advisory says attackers can erase log entries, clean logs do not clear an appliance, and the dummyuser account entries Cisco flags are the detection defenders are handed.
Next story · Security · Oct 6
Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flawConfirmed15 publishers
"Insufficient authentication control on an API endpoint" is the entire technical description in Cisco's advisory [4]. Read literally, that means the endpoint answers before it establishes who is calling. The request never goes through the web management interface, so the admin roles and whatever MFA sits in front of the ISE web console never see it [5].
Cisco found the defect while working a Technical Assistance Center support case, and the dev.to write-up takes that provenance as a sign of real-world activity [3]. A support case is an unusual way to find your own CVSS 10.0.
The fixes are branch-specific, and there are five of them: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 [9][21]. Cisco lists no patch for the 3.0 line, because that release reached End of Software Maintenance, and Cisco advises customers on it to migrate to a supported release that includes the fix [13]. Cisco's own remediation language is blunt: the advisory "strongly recommends that customers upgrade to the fixed software indicated in this advisory" [17], and it treats any workaround or mitigation as a temporary solution until that upgrade happens [19].
Cisco's PSIRT validates only the affected and fixed release information documented in the advisory [18]. The write-up's reference list also includes a CISA alert adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on September 16, 2026 [20].
The exposure figure in circulation comes from a scanner. The dev.to write-up reports 4,051 instances worldwide for the product fingerprint app="Cisco ISE", and 0 for a filter on vul.cve="CVE-2026-76460", which it attributes to ZoomEye not yet indexing the new identifier [14][15]. The same write-up says the product count describes assets matching the fingerprint and does not confirm that every one is vulnerable [16]. For it to be a count of exploitable targets, every match would have to be a live ISE on 3.1 through 3.5, unpatched, with the vulnerable endpoint reachable from wherever the scanner sat [7].
What to watch
- A CISA remediation due date attached to the KEV entry would turn vendor advice into a fixed clock for federal ISE operators.
- If Cisco adds a workaround or explicit ACL guidance to the advisory, the pre-patch options change for estates that cannot upgrade this week.
- A version-resolved scan count that separates patched from unpatched ISE hosts would replace the 4,051 fingerprint figure with something usable.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption42
- Hype gap+6
- Incentives38
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On September 16, 2026, Cisco disclosed that CVE-2026-76460, a maximum-severity flaw in Cisco Identity Services Engine, is being exploited in the wild; it carries a CVSS score of 10.0 and lets an unauthenticated remote attacker bypass authentication on an API endpoint and gain root privileges on the appliance.
- [2]
Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation of CVE-2026-76460.
- [3]
Cisco discovered the defect while working a Technical Assistance Center support case, which the write-up says suggests real-world activity rather than a purely theoretical finding.
- [4]
The advisory states that the flaw stems from "insufficient authentication control on an API endpoint."
- [5]
An attacker sends crafted network requests directly to an exposed API endpoint; because the endpoint's authentication control is insufficient, the request bypasses the web management interface entirely, no prior authentication is required, and the attacker can then execute commands with root privileges on the underlying system.
- [6]
ISE enforces identity and access policy across enterprise networks, so an attacker who owns the appliance can manipulate access rules and pivot deeper into internal subnets.
- [7]
The vulnerability affects Cisco ISE and Cisco ISE-PIC across all device configurations, with affected releases running from 3.1 through 3.5.
- [8]
The advisory notes that attackers can erase log entries to conceal their activity, complicating post-incident forensics.
- [9]
Cisco released fixed releases 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
- [10]
Cisco has not published a temporary workaround for CVE-2026-76460.
- [11]
Defenders can reduce exposure by using infrastructure access control lists to block untrusted traffic from reaching ISE management interfaces.
- [12]
Teams should review access logs for suspicious dummyuser account entries, which the advisory flags as an indicator worth checking.
- [13]
Cisco ISE Software Release 3.0 has reached End of Software Maintenance, and customers are advised to migrate to a supported release that includes the fix for this vulnerability.
- [14]
A ZoomEye query for the product fingerprint app="Cisco ISE" returned 4,051 matching instances globally.
- [15]
A separate ZoomEye CVE filter, vul.cve="CVE-2026-76460", returned 0, which the write-up says is expected for a recently disclosed CVE that ZoomEye has not yet indexed under that identifier.
- [16]
The write-up states that the product-query count describes assets matching the Cisco ISE fingerprint and does not confirm that every one of those assets is vulnerable to this specific CVE.
- [17]
"To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory."
- [18]
"The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory."
- [19]
Cisco considers any workarounds and mitigations to be temporary solutions until an upgrade to a fixed software release is available.
- [20]
The write-up's reference list includes a CISA alert dated September 16, 2026, adding two known exploited vulnerabilities to CISA's catalog.
- [21]
The fix list covers five release branches, one patch level each, and contains no fixed release for the 3.0 line.
Sources
2 independent publishers whose own reporting we read for this story.
- Cisco Identity Services Engine Authentication Bypass Vulnerability - Cisco
cisco.com
1 article · September 18, 2026
- dev.toCisco ISE Authentication Bypass CVE-2026-76460: What Defenders Need to Do Now
2 articles · September 19, 2026