Cisco ISE Vulnerability CVE-2026-76460: Exploited Authentication Bypass on the Network Gatekeeper, and the Fixed Versions to Install

Cisco has confirmed that attackers are exploiting a flaw in Cisco Identity Services Engine (ISE), the system many companies use to decide which people and devices get onto their network. If your ISE nodes have not been patched since mid-September, an attacker on the network may be able to get past the ISE login without a password and run commands as root on the system that controls your network access.

The same release also fixed four more ISE authentication bypass flaws and a batch of critical issues from Cisco's own review. The good news: the same patch levels cover nearly all of them.

What happened with Cisco ISE

On Wednesday, September 16, 2026, Cisco published three related advisories for ISE and ISE Passive Identity Connector (ISE-PIC):

• CVE-2026-76460, an authentication bypass rated CVSS 10.0 (Critical). Cisco says an API in ISE has "insufficient authentication control," so an attacker with no login can send a crafted request and get past the web-based management interface. Cisco states: "The Cisco PSIRT is aware of active exploitation of this vulnerability." CISA added it to its Known Exploited Vulnerabilities catalog the same day.
• A hardening release covering six vulnerability classes (CVE-2026-20130, CVE-2026-20192, CVE-2026-20194, CVE-2026-20234, CVE-2026-20237 and CVE-2026-20287), with scores up to 10.0. Cisco says it found these through internal testing and with frontier AI models.
• Four Medium-rated authentication flaws (CVE-2026-76439, CVE-2026-76444, CVE-2026-76446 and CVE-2026-76447), reported by researchers at STAR Labs and an independent researcher. Cisco updated that advisory on September 24 to add a researcher credit.

Cisco says none of these issues has a workaround. Upgrading is the fix.

What is confirmed and what is not known

Confirmed by Cisco and CISA:

• CVE-2026-76460 is being exploited, and it affects ISE and ISE-PIC regardless of configuration.
• If an attacker succeeds, they may get root-level command execution, which Cisco warns could let them remove or hide evidence.
• Cisco found the flaw while working a Technical Assistance Center support case.

What the four Medium flaws do, per Cisco's descriptions:

• CVE-2026-76439: an attacker with no login can submit fake device "posture" reports through the guest portal. Posture is ISE's check on whether a device is healthy enough to connect. Cisco titles this one "Remote Code Execution," but the description only covers forged posture status, and the advisory does not explain the difference.
• CVE-2026-76444: an attacker with no login can pull sensitive configuration information from an internal ISE service.
• CVE-2026-76446: an attacker who already has an admin-level login can read certain files through an XML flaw in an API.
• CVE-2026-76447: an attacker with no login can force ISE to reload the certificate and key used by its OCSP responder (the service that tells devices whether a certificate is still valid).

For these four, Cisco says it is aware of a public announcement but not of any malicious use.

Not known: who is exploiting CVE-2026-76460, how many organizations have been hit, and when the attacks started. Cisco has not published attack details.

Which Cisco ISE versions are fixed

Two details matter here. First, if you are on 3.1 or 3.2, the patch closes the exploited flaw but not the four Medium flaws. Cisco notes those releases only get critical fixes and recommends moving to a supported release. Second, ISE-PIC is end of sale, and 3.4 is its last supported release.

How to check if your Cisco ISE was already attacked

The fix landed seven weeks ago, so if you patched late, check for signs of attack too. Cisco's advisory gives this command to run on each ISE node:

show logging application ise-kong/access.log | include dummyuser

Cisco says any output may mean malicious activity. Run it on every node in a distributed deployment. For older logs, Cisco says to collect a support bundle with debug logs included and check the API gateway access logs inside it.

If you find something, Cisco strongly recommends re-imaging the affected nodes and restoring configuration from a backup if needed. Since an attacker with root can clean up logs, Cisco also advises checking network and firewall logs for unexpected uploads from ISE to outside IP addresses or downloads from malicious ones.

What to do this week

• Check your version. Run show version in the ISE CLI, or go to Administration > System > Maintenance > Patch Management in the GUI and use Show Node Status to see each node.
• Patch every node to the fixed release in the table above. One unpatched node is still an open door.
• Plan a migration if you are on 3.2 or earlier, or on ISE-PIC older than 3.4.
• Limit who can reach ISE management with infrastructure access lists, so only admin networks can connect. Cisco presents this as a temporary measure until you upgrade, not a fix.
• Run the log check above on every node, even if you are already patched.
• Review outbound traffic from ISE nodes in your firewall logs since mid-September.
• Turn on detection if you run Snort or Cisco Secure Firewall: Cisco lists Snort rules 67112 to 67113, 67118 to 67120, and 67135 with the hardening release.
• Ask your provider for written confirmation of the patch level if someone else manages your network.

Why it matters for a company network

ISE is the gatekeeper. It decides whether a laptop gets on the corporate Wi-Fi, which guest gets internet-only access, and whether a device without current security software gets blocked. Healthcare groups, manufacturers, schools and multi-site offices use it to keep the right people and machines in the right parts of the network.

An attacker with root on ISE does not need to break into each system one at a time. They can change the rules about who gets in, read configuration that may hold network secrets, and hide their tracks on the box that is supposed to be watching. That is why a flaw in an access control system is worse than a flaw in an ordinary server.

This follows a pattern we have covered before with the Cisco SD-WAN login bypass and the Cisco ASA ACL bypass: network appliances are trusted completely and patched slowly. If urgent fixes like this tend to stall in your organization, our guide to getting security patches approved faster may help.

Cisco ISE vulnerability questions people are asking

Is Cisco ISE being actively exploited?

Yes. Cisco confirms active exploitation of CVE-2026-76460, and CISA added it to its exploited vulnerabilities catalog on September 16, 2026.

What is CVE-2026-76460?

It is an authentication bypass in a Cisco ISE API, rated CVSS 10.0. An attacker with no login can get past the management interface and may get root access.

Is there a workaround for the Cisco ISE vulnerability?

No. Cisco says there are no workarounds. Limiting access to ISE management with access lists reduces exposure until you can upgrade.

Which Cisco ISE patch do I need?

3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. On 3.1 and 3.2, Patch 12 and Patch 11 fix the exploited flaw, but Cisco recommends migrating.

Does this affect Cisco ISE-PIC?

Yes. ISE-PIC is affected by CVE-2026-76460 and three of the four Medium flaws. Its last supported release is 3.4.

Is CVE-2026-76439 a remote code execution flaw?

Cisco's title says so, but its description only covers forging device posture status. Cisco has not explained the difference.

How do I check my Cisco ISE version?

Run show version in the CLI, or open Administration > System > Maintenance > Patch Management in the GUI.

The bigger lesson

The system that guards your network needs the most attention, not the least. ISE, firewalls and VPN gateways often go years without anyone checking them, because they work. Attackers count on that. Put your network gatekeepers on the same patch schedule as everything else, and know who owns them. If nobody can say who patches yours, read who is patching the software that runs your business.

Want help hardening your network access controls? See security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Cisco ISE Authentication Bypass Vulnerability advisory; Cisco ISE Authentication Bypass Vulnerabilities advisory; Cisco ISE Hardening Release: September 2026; CISA Adds Two Known Exploited Vulnerabilities to Catalog; Cisco ISE 3.3 Upgrade Guide: Install Latest Patch.