CVE-2026-76460: Cisco ISE Privileged API Misuse Enables Unauthenticated Management Interface Bypass

Background

Cisco Identity Services Engine (ISE) is a network access control (NAC) and policy platform used by enterprises to authenticate and authorize devices and users connecting to wired, wireless, and VPN networks. Cisco ISE Passive Identity Connector (ISE-PIC) extends identity visibility by passively collecting authentication events from existing infrastructure such as Active Directory domain controllers. Both products sit at the heart of an organization’s network access decisions — ISE determines who and what is allowed onto the network, and under what policy — making it a foundational trust anchor. A compromise of ISE does not just expose one system; it can undermine the access control guarantees for an organization’s entire network.

Technical Mechanism

CVE-2026-76460 is classified under CWE-648, Incorrect Use of Privileged APIs. CISA’s KEV description states that the flaw allows “an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.”

CWE-648 describes situations where an application exposes or calls privileged internal APIs without adequately verifying that the calling context is authorized to invoke them at that privilege level. In the context of ISE’s web-based management interface, this typically means that some internal API or service call — intended to be reachable only after the management interface’s normal authentication has succeeded — is instead reachable, or can be triggered, through a path that does not enforce that same authentication check. An attacker exploiting this would craft requests directly against the underlying privileged API (rather than going through the authenticated web UI flow), allowing them to perform management-interface-equivalent actions — such as retrieving configuration, modifying policy, or accessing administrative functionality — without ever supplying valid credentials.

Because ISE’s management interface controls the policy engine that governs network admission decisions, bypassing its authentication doesn’t just expose the interface itself; it can expose the ability to alter who is granted or denied access to the network, or exfiltrate configuration data such as integrated directory service credentials, RADIUS/TACACS+ shared secrets, and certificate authority material used by the platform.

Real-World Exploitation Evidence

CVE-2026-76460 was added to CISA’s KEV catalog on 2026-09-16, confirming CISA has evidence of active exploitation in the wild as of that date. CISA’s data lists knownRansomwareCampaignUse as “Unknown” — CISA has not confirmed use of this vulnerability in ransomware campaigns at this time. No specific threat actor or named campaign has been publicly attributed to exploitation of this CVE in the data available for this article; the KEV listing confirms active in-the-wild exploitation, but attribution detail is not yet public.

Impact Assessment

A CVSS score of 10.0 reflects unauthenticated, network-exploitable compromise with full impact to confidentiality, integrity, and availability:

• Unauthorized administrative access to a network access control platform means an attacker can potentially view or modify the policies that determine which devices and users are permitted onto the network — a foothold that can be leveraged to grant rogue devices trusted access or deny access to legitimate ones.
• Exposure of integrated credential material: ISE typically holds RADIUS/TACACS+ shared secrets, directory-service (Active Directory/LDAP) bind credentials, and certificate authority configuration used across the network — all high-value targets once management access is obtained.
• Network-wide trust impact: because ISE decisions affect every device attempting network admission across wired 802.1X, wireless, and VPN access layers, a compromised ISE deployment can undermine access control assurances enterprise-wide, not just for a single segment.
• Sector exposure: ISE is heavily deployed in regulated and large enterprise environments (healthcare, finance, government, higher education) where NAC is a compliance control; a bypass here has both security and compliance implications.

Affected Versions

The KEV data does not include an explicit affected-version table. Organizations should consult Cisco’s security advisory (linked in References) for the definitive affected and fixed version list for ISE and ISE-PIC.

Remediation Steps

CISA’s required action is to apply mitigations per vendor instructions, consistent with BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable.

1. Apply Cisco’s fixed software release identified in the linked security advisory for both ISE and ISE-PIC as applicable to your deployment.
2. Restrict management interface exposure to a dedicated, access-controlled management network — the web-based management interface should never be reachable from general user networks or the internet.

   # Example: restrict ISE admin portal access via ACL on upstream firewall/router
   access-list ISE_ADMIN permit tcp 10.10.5.0 0.0.0.255 host <ISE_IP> eq 443
   access-list ISE_ADMIN deny tcp any host <ISE_IP> eq 443

3. Rotate integrated credentials — RADIUS/TACACS+ shared secrets, AD bind account passwords, and any API credentials configured in ISE — if there is any indication of exposure prior to patching.
4. Review administrative and policy change audit logs for unexpected modifications made during the period the system was unpatched.
5. Evaluate internet exposure of all ISE/ISE-PIC management interfaces and prioritize patching internet-reachable instances first, consistent with BOD 26-04.

Detection Guidance

• ISE administrative and API audit logs: Review for privileged API calls or management actions that do not correlate with a valid authenticated administrator session.
• Unusual authentication patterns: Alert on administrative actions performed without a preceding successful login event in the authentication log stream.
• Network-level monitoring: Watch for requests to ISE’s management interface or underlying API ports from source addresses outside the designated management network.
• Exact IOC and signature guidance for this specific bypass technique should be sourced from Cisco’s advisory and current IDS/SIEM vendor feeds once published, as specific published signatures were not available in the data reviewed for this article.

Timeline

References

• Cisco Security Advisory — cisco-sa-ISE-ABP-VNSW7Tn5
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 — Forensics Triage Requirements Implementation Guidance
• NVD — CVE-2026-76460