Fixing and finding
Jump to remediation plan
CVE ID
CVE-2026-76460
Published 2026-09-16
Updated 17 days ago
Vendor/s
Cisco
Product/s
Identity Services Engine
Version/s
3.1.0
KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog. Active
exploitation observed in the wild.
CVSS Score (v3.1)
10
/ 10
Critical
Severity Details
Base score
10 Critical
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Description
CVE-2026-76460 is a CVSS 10.0 authentication bypass vulnerability in Cisco ISE being actively exploited. Immediate patching is required.
CPE
Cisco
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine | 3.5.0 | 3.5.0 | vulnerable |
| identity_services_engine | 3.5.0 | 3.5.0 | vulnerable |
| identity_services_engine | 3.5.0 | 3.5.0 | vulnerable |
| identity_services_engine | 3.5.0 | 3.5.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.1.0 | 3.1.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.2.0 | 3.2.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.3.0 | 3.3.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
| identity_services_engine_passive_identity_connector | 3.4.0 | 3.4.0 | vulnerable |
Related weakness (CWE)
CWE-648
Remediation plan
1
Apply official patches
Consult the Cisco Security Advisory (cisco-sa-ISE-ABP-VNSW7Tn5) to identify and apply the specific software patches or hotfixes released by Cisco to address the API authentication logic.
2
Update affected systems
Upgrade Cisco ISE and Passive Identity Connector instances from vulnerable versions (including 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0) to the latest fixed release recommended by the vendor.
3
Restrict access
Implement strict Access Control Lists (ACLs) or firewall rules to limit access to the ISE management interface and API endpoints to only trusted administrative IP addresses and secure internal networks.
4
Monitor for exploitation
Conduct a forensic triage of ISE logs as per CISA BOD 26-04 requirements, looking for unusual API requests or unauthorized administrative sessions originating from unexpected external sources.
Detection Guidance
"Monitor web server and API logs for HTTP requests directed at management endpoints that return a 200 OK status without preceding valid authentication events. Look for unusual source IP addresses accessing the ISE web interface. Security teams should deploy network signatures to detect crafted API calls designed to exploit authentication logic. Review Cisco ISE audit logs for any unauthorized configuration changes or new administrative account creations."
References
Sources
NIST National Vulnerability Database (NVD)
CISA Known Exploited Vulnerabilities (KEV)