The Cisco ISE vulnerability tracked as CVE-2026-76460 carries the maximum CVSS score of 10.0 and is being exploited now. Cisco published its advisory on 16 September 2026 covering Identity Services Engine and ISE-PIC releases 3.0 through 3.5. CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a 19 September deadline.
What CVE-2026-76460 Actually Does
An unauthenticated attacker anywhere on the network can take root control of the appliance by sending one crafted request. Cisco Identity Services Engine, usually shortened to ISE, is the platform that decides which users and devices are allowed onto a corporate network, so control of it is control of the front door.
Cisco Systems, the American networking company, describes the cause as “insufficient authentication control on an API endpoint”. Because the endpoint does not check credentials properly, an attacker bypasses the web-based management interface entirely. Cisco states that a successful exploit can give the attacker command execution with root privileges.
The flaw affects both Cisco ISE and the Cisco ISE Passive Identity Connector, known as ISE-PIC, regardless of how the device is configured. There is no setting that switches off the exposure.
Which Cisco ISE Versions Are Fixed
Every supported release train has a patch, and one train has nothing at all. These are the first fixed releases Cisco names in the advisory.
| Release train | First fixed release | Status |
|---|---|---|
| ISE / ISE-PIC 3.0 | None | End of software maintenance; migration required |
| ISE / ISE-PIC 3.1 | 3.1 Patch 12 | Critical fixes only |
| ISE / ISE-PIC 3.2 | 3.2 Patch 11 | Critical fixes only |
| ISE / ISE-PIC 3.3 | 3.3 Patch 12 | Supported |
| ISE / ISE-PIC 3.4 | 3.4 Patch 7 | Supported |
| ISE / ISE-PIC 3.5 | 3.5 Patch 4 | Supported |
Cisco states that no workarounds address this vulnerability. Access control lists, management-interface restrictions and configuration changes are not offered as substitutes for the patch.
Why ISE 3.0 Gets Nothing
Release 3.0 is vulnerable and will not be fixed. It has passed end of software maintenance, so Cisco is issuing no patch for it at all, and the only route off the vulnerability is migration to a supported train.
Anyone still on 3.0 is therefore facing an upgrade project rather than a patch window, while the flaw is being exploited. Cisco’s advice for 3.1 and 3.2 users is similar in spirit: those trains receive critical fixes only, so Cisco points customers towards 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 as the durable destination.
How to Patch and Then Hunt
Patching closes the hole but tells you nothing about whether it was already used. Cisco’s own guidance treats these as two separate jobs.
- Identify the train: Check which of 3.0 to 3.5 each node runs, including every node in a distributed deployment, not just the primary administration node.
- Upgrade to the first fixed release: Apply 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 as appropriate. For 3.0, plan a migration instead.
- Review the API gateway log: Cisco directs administrators to inspect access.log for suspicious usernames, using show logging application ise-kong/access.log with a username filter, on every node in the deployment.
- Collect a support bundle: With debug logging enabled, examine the archived apigateway access log inside the bundle for the same signs.
- Cross-check off the box: Compare network and firewall logs for unexpected uploads, downloads or outbound connections involving an ISE node.
Step five is the one that matters most, and it is the step most coverage omits. Root privileges let an intruder edit or delete the on-device logs that steps three and four rely on, so a clean access.log is not proof of a clean system. Only records held somewhere the attacker did not control can settle the question. The same pattern surfaced in the PaperCut intrusion campaign, where post-compromise hunting mattered as much as the patch.
Where malicious activity is suspected, Cisco’s recommendation is blunt: re-image the affected nodes and restore from a configuration backup if needed.
Who Must Patch by 19 September
US federal civilian agencies have a hard deadline of Saturday 19 September 2026. CISA, the US Cybersecurity and Infrastructure Security Agency, added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on 16 September 2026 with that due date, under binding operational directive BOD 26-04.
The directive binds Federal Civilian Executive Branch agencies only. It does not apply to private companies, universities or agencies outside the United States. In practice the catalog is treated worldwide as a signal that exploitation is real rather than theoretical, which is the difference between this flaw and a high score alone. A CVSS 10.0 without attacks behind it, such as the SAP OVERPASS vulnerability reported earlier this month, does not carry the same urgency.
What Cisco Has Not Said
As of 18 September 2026, Cisco has confirmed that exploitation is happening but has released none of the detail that would let defenders scope it. The advisory names no threat actor, gives no count of compromised organisations, publishes no attacker IP addresses or file hashes, and does not say when the first attack occurred.
Cisco’s Product Security Incident Response Team says only that it “is aware of active exploitation of this vulnerability” and that customers should upgrade. The verbatim position is on the Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5. No proof-of-concept code has been published by Cisco, and the company has not said whether one is circulating.
Frequently Asked Questions
What Is CVE-2026-76460?
It is an authentication bypass flaw in an API endpoint of Cisco Identity Services Engine and ISE-PIC, rated CVSS 10.0. An unauthenticated remote attacker can send a crafted request and obtain command execution with root privileges.
Which Cisco ISE Versions Fix the Vulnerability?
ISE and ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Release 3.0 has passed end of software maintenance and receives no fix.
Is There a Workaround for the Cisco ISE Vulnerability?
No. Cisco states that no workarounds address this vulnerability, so upgrading to a fixed release is the only remediation.
What Should Cisco ISE 3.0 Users Do?
Migrate to a supported release, because no patch is coming for 3.0. Cisco points customers towards 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 rather than the critical-fix-only 3.1 and 3.2 trains.
How Do I Check Whether My Cisco ISE Was Already Breached?
Review access.log on every node for suspicious usernames and inspect the apigateway access log in a debug-enabled support bundle. Then cross-check external network and firewall logs, because root access allows an attacker to alter on-device logs.
Does the 19 September Deadline Apply Outside the United States?
No. The CISA due date binds US Federal Civilian Executive Branch agencies under BOD 26-04. Other organisations face no legal deadline, though the catalog listing confirms attacks are already under way.
