Cisco has released patches for an actively exploited authentication-bypass vulnerability in Identity Services Engine, warning that remote attackers can gain unauthorized access to affected devices without signing in.
The flaw, tracked as CVE-2026-76460, has a maximum CVSS severity score of 10.0. It affects both Cisco ISE and ISE Passive Identity Connector, regardless of device configuration. Cisco says insufficient authentication controls on an API endpoint allow a crafted request to bypass the web-based management interface.
The company’s Product Security Incident Response Team confirmed active exploitation after the vulnerability was identified during a Technical Assistance Center support case. Cisco also warns that successful exploitation may give attackers command execution with root privileges, allowing them to remove or conceal evidence on a compromised device.
CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. The entry lists September 19 as the remediation due date and includes a forensic triage requirement under its federal security-update guidance.
The first fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Version 3.0 has reached the end of software maintenance, and Cisco advises users to migrate to a supported release that includes the fix.
Cisco says there is no workaround that addresses the vulnerability. As a temporary mitigation, administrators can use infrastructure access control lists to restrict traffic to required management and control-plane connections. The company recommends upgrading to patched software for remediation.
Access-control weaknesses are a separate exposure from credential leakage, which has been documented in public configurations used by AI coding tools. Federal identity protections also include NIST and CISA’s newly finalized token-security guidance, covering short-lived credentials and key rotation.
Cisco recommends reviewing access logs for suspicious usernames on every node in a distributed deployment. Administrators can collect a support bundle with debug logs enabled and shared-key encryption to inspect additional archived access logs. Because attackers with root access may alter local evidence, administrators should also examine external network and firewall logs for unusual transfers. If malicious activity is suspected, Cisco strongly recommends re-imaging affected nodes and restoring configuration backups as needed.
Sources: Cisco, CISA Known Exploited Vulnerabilities Catalog
–
By the ID Tech Editorial Team
