Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-76460 Published 2026-09-16 Updated 18 days ago Vendor/s Cisco Product/s Identity Services Engine Version/s 3.1.0 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 10 / 10 Critical Severity Details Base score 10 Critical Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality High Integrity High Availability High Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description CVE-2026-76460 is a CVSS 10.0 authentication bypass vulnerability in Cisco ISE being actively exploited. Immediate patching is required. ## Why this matters "This CVE is of the highest critical severity (CVSS 10.0) because it allows unauthenticated, remote attackers to completely bypass authentication on Cisco Identity Services Engine (ISE). Since ISE is a central pillar for network access control and security policy enforcement, a compromise here could grant an attacker full control over the network's identity infrastructure. Its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog indicates that this flaw is being actively leveraged in the wild, making immediate remediation a top priority for security teams to prevent unauthorized administrative access and potential lateral movement across the enterprise." ## CPE Cisco | Product | Version Start | Version End (excl.) | Status | | -------------------------------------------------------- | ------------- | ------------------- | ---------- | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine | 3.5.0 | 3.5.0 | vulnerable | | identity\_services\_engine | 3.5.0 | 3.5.0 | vulnerable | | identity\_services\_engine | 3.5.0 | 3.5.0 | vulnerable | | identity\_services\_engine | 3.5.0 | 3.5.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.1.0 | 3.1.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.2.0 | 3.2.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.3.0 | 3.3.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | | identity\_services\_engine\_passive\_identity\_connector | 3.4.0 | 3.4.0 | vulnerable | ## Related weakness (CWE) CWE-648 ## Remediation plan 1 ### Apply official patches Consult the Cisco Security Advisory (cisco-sa-ISE-ABP-VNSW7Tn5) to identify and apply the specific software patches or hotfixes released by Cisco to address the API authentication logic. 2 ### Update affected systems Upgrade Cisco ISE and Passive Identity Connector instances from vulnerable versions (including 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0) to the latest fixed release recommended by the vendor. 3 ### Restrict access Implement strict Access Control Lists (ACLs) or firewall rules to limit access to the ISE management interface and API endpoints to only trusted administrative IP addresses and secure internal networks. 4 ### Monitor for exploitation Conduct a forensic triage of ISE logs as per CISA BOD 26-04 requirements, looking for unusual API requests or unauthorized administrative sessions originating from unexpected external sources. ## Detection Guidance "Monitor web server and API logs for HTTP requests directed at management endpoints that return a 200 OK status without preceding valid authentication events. Look for unusual source IP addresses accessing the ISE web interface. Security teams should deploy network signatures to detect crafted API calls designed to exploit authentication logic. Review Cisco ISE audit logs for any unauthorized configuration changes or new administrative account creations." ## References [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 Mitigation Vendor Advisory ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-76460 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)