AnswersPublished22 sources
Cisco ISE CVE-2026-76460 Is an Actively Exploited, Pre-Auth Root Compromise Risk
CVE 2026 76460 is an actively exploited CVSS 10.0 flaw in Cisco ISE and ISE PIC: a crafted API request can bypass authentication and lead to root level command execution without credentials or user interaction. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026 and set...
Published byEdited with GPT-5.6 TerraImages generated with GPT Image 2
Research answer
Key takeaways
- CVE 2026 76460 is an actively exploited CVSS 10.0 flaw in Cisco ISE and ISE PIC: a crafted API request can bypass authentication and lead to root level command execution without credentials or user interaction.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026 and set a September 19 remediation deadline for U.S.
- Treat potentially exposed or suspicious ISE nodes as incident response cases, not simply patching tasks: preserve evidence, investigate access and configuration changes, and rebuild systems that cannot be established...
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is the significance of Cisco’s actively exploited maximum-severity zero-day CVE-2026-76460 in Cisco Identity Services Engine (ISE) and. Article summary: CVE-2026-76460 is an emergency, internet-facing identity-infrastructure compromise risk: an unauthenticated remote attacker can send a crafted request to a vulnerable ISE/ISE-PIC API endpoint, bypass authentication, and . Topic tags: general, government, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, cha
CVE-2026-76460 is unusually consequential because it targets identity infrastructure and is already being exploited. The flaw affects Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), allowing an unauthenticated remote attacker to bypass authentication through a vulnerable API endpoint. Cisco reporting describes successful exploitation as enabling root-level command execution on an affected device. 1
3
48
Why this zero-day is an emergency
The vulnerability has a CVSS 10.0 rating, the maximum score, and affects ISE and ISE-PIC regardless of device configuration. Exploitation does not require valid credentials or user interaction: an attacker sends a crafted request to the affected API endpoint and bypasses the web-based management interface. 1
3
40
Cisco disclosed active exploitation on September 16, 2026. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a September 19 deadline for U.S. federal civilian agencies to remediate it. 1
9
15
There is no workaround that removes the underlying vulnerability. Installing Cisco's fixed software is the remediation for supported releases. 2
16
What an authentication bypass means in ISE
ISE is a network identity and access-control platform, so a successful compromise may put a high-value control point at risk. The immediate technical issue is an API authentication failure: insufficient authentication controls allow a crafted request to bypass intended access checks. 1
40
The impact reported for CVE-2026-76460 goes beyond viewing the management interface. An unauthenticated attacker may gain root-level command execution, meaning the attacker could control the affected appliance or virtual node. 3
48
That makes this a potential incident-response event for organizations with vulnerable systems, particularly where ISE management or API interfaces are reachable from untrusted networks or broadly accessible internal segments. Publicly available reporting confirms active exploitation, but it does not identify the attackers, victim scope, exploit tooling, initial exploitation date, or confirmed post-compromise activity. 1
15
Fixed Cisco ISE and ISE-PIC releases
Cisco's first fixed releases are:
| Release branch | First fixed release |
|---|---|
| ISE / ISE-PIC 3.1 | 3.1 Patch 12 |
| ISE / ISE-PIC 3.2 | 3.2 Patch 11 |
| ISE / ISE-PIC 3.3 | 3.3 Patch 12 |
| ISE / ISE-PIC 3.4 | 3.4 Patch 7 |
| ISE / ISE-PIC 3.5 | 3.5 Patch 4 |
Organizations running ISE 3.0 should plan to migrate to a supported release. Release 3.0 has reached end of software maintenance and will not receive the fix. Restricting administrative and API exposure can reduce exposure during a migration, but it is not a substitute for moving to a fixed, supported version. 2
16
48
A practical response plan
1. Identify every affected node and patch supported deployments
Inventory ISE and ISE-PIC deployments, including administration, policy-service, monitoring, and passive-identity nodes. Confirm both the installed release and patch level, then upgrade supported systems to the applicable first fixed release or later. 3
13
2. Preserve evidence before making disruptive changes
Where operationally feasible, collect relevant logs, system and network state, configuration information, and a vendor-supported support bundle before patching or rebuilding. CISA's KEV entry directs agencies to follow its forensics-triage requirements alongside vendor remediation guidance. 1
3. Investigate for signs of unauthorized access
Review ISE application and administrative audit records for unexpected API activity, authentication events, administrator changes, policy changes, certificate changes, configuration exports, and repository modifications. Correlate those events with firewall, VPN, reverse-proxy or load-balancer, DNS, EDR, and network-flow telemetry for connections to ISE management interfaces or unusual outbound activity.
Search the period before patching through the present. A clean-looking web interface alone is not sufficient evidence that a system was never accessed, especially when the reported impact includes root-level execution. 3
48
4. Reimage systems that may have been compromised
Patching closes the vulnerable entry point; it does not by itself establish that a previously compromised host is clean. Rebuild rather than merely patch a node with evidence of exploitation, unexplained root-level changes, suspicious processes, files or connections, altered trust material, or configuration changes that cannot be explained.
Restore only from a backup validated as predating the suspected compromise period, apply the fixed release before reconnecting, and rotate credentials or secrets that may have been stored on or reachable from the affected node. This can include ISE administrative accounts, API and repository credentials, and potentially exposed certificates or keys.
How CVE-2026-76460 compares with CVE-2026-76461
CVE-2026-76460 was Cisco's second actively exploited zero-day disclosed that week. The other, CVE-2026-76461, is a CVSS 9.8 SQL-injection vulnerability in Cisco AsyncOS email parsing for Cisco Secure Email Gateway. A remote unauthenticated attacker can send a crafted email containing malicious SQL statements through a vulnerable gateway, potentially resulting in root-level command execution. 33
44
The two vulnerabilities have different entry points:
- CVE-2026-76460: a crafted request to an ISE or ISE-PIC API endpoint bypasses authentication.
1
40
- CVE-2026-76461: malicious email content reaches vulnerable email-parsing logic in Cisco Secure Email Gateway.
33
Both are especially urgent because they are reported as actively exploited, remotely reachable, and capable of producing root-level control without prior authentication. 15
33
44
Available evidence directly confirms Cisco Secure Email Gateway as the affected product for CVE-2026-76461. Some reports also list Cisco Secure Email and Web Manager in broader Cisco email-product advisories, but patch planning should rely on Cisco's product-specific advisory and release guidance for each deployed product. 33
41
What remains unknown
Active exploitation and the technical severity are confirmed, but key operational details remain public unknowns. Cisco's public disclosures and contemporary reporting do not establish who is behind the activity, how many organizations were affected, when exploitation began, what tools were used, or what attackers did after gaining access. 1
15
Reports of post-disclosure scanning should be treated as an additional reason to accelerate remediation, but the supplied evidence does not support a reliable estimate of scanning volume or attribution to a particular actor. The defensible conclusion is simpler: a maximum-severity, no-workaround, actively exploited authentication bypass in identity infrastructure should be patched immediately and investigated whenever exposure or suspicious activity makes compromise plausible. 1
3
48
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Cisco ISE CVE-2026-76460 Is an Actively Exploited, Pre-Auth Root Compromise Risk"?
CVE 2026 76460 is an actively exploited CVSS 10.0 flaw in Cisco ISE and ISE PIC: a crafted API request can bypass authentication and lead to root level command execution without credentials or user interaction.
What are the key points to validate first?
CVE 2026 76460 is an actively exploited CVSS 10.0 flaw in Cisco ISE and ISE PIC: a crafted API request can bypass authentication and lead to root level command execution without credentials or user interaction. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026 and set a September 19 remediation deadline for U.S.
What should I do next in practice?
Treat potentially exposed or suspicious ISE nodes as incident response cases, not simply patching tasks: preserve evidence, investigate access and configuration changes, and rebuild systems that cannot be established...