CISA adds actively exploited Cisco ISE authentication bypass CVE-2026-76460 to KEV

What happened

CISA added CVE-2026-76460, an authentication bypass in Cisco Identity Services Engine (ISE), to the Known Exploited Vulnerabilities catalog on 16 September 2026, citing evidence of active exploitation [1][2]. The remediation deadline for federal civilian agencies was set at 19 September 2026 — three days [1].

Cisco has warned that the flaw is being exploited in attacks and carries a CVSS score of 10.0, the maximum [3]. According to Cisco’s description, the problem is insufficient authentication control on an API endpoint: an unauthenticated remote attacker can send a crafted request and gain unauthorised access to the device, bypassing the web-based management interface [1][3].

The same KEV update included CVE-2026-87886, an incorrect default permissions vulnerability in Acronis Backup [2]. This post covers the Cisco issue; the Acronis entry is worth checking separately if you run that product.

The Hacker News describes the ISE flaw as a zero-day [3]. The sources provided here do not state when exploitation began, who is conducting it, or how many organisations have been affected. CISA records known ransomware use as “Unknown” [1].

Who is affected

CISA’s catalogue entry names both Cisco Identity Services Engine and the Cisco ISE Passive Identity Connector (ISE-PIC) as containing the vulnerability [1].

None of the sources here list the specific affected or fixed release trains, so you will need to read Cisco’s own advisory to work out whether your deployment is in scope and which version to move to. Treat every ISE and ISE-PIC node as potentially affected until you have confirmed otherwise against that advisory.

The sources describe the outcome of exploitation only as unauthorised access to the affected device by bypassing the web-based management interface [1][3]. They do not state what privilege level an attacker obtains, and none of the material reviewed here describes the product’s role in a network. The CVSS vector supplied with this CVE includes a scope change and high impact to confidentiality, integrity and availability, which indicates impact beyond the vulnerable component itself.

How it works

The mechanism, as far as the sources describe it, is simple: an API endpoint does not enforce authentication properly [3]. A crafted request to that endpoint is enough to obtain unauthorised access to the appliance without credentials and without user interaction [1][3]. The published vector — network attack vector, low complexity, no privileges required, no user interaction, changed scope, high impact across all three properties — is what produces the 10.0.

The sources do not name the endpoint, do not describe post-exploitation behaviour, and do not publish indicators of compromise. Public exploitation details beyond a crafted request to an affected API endpoint are not available in the material reviewed here [3].

Note what the vulnerability class implies for detection. An authentication bypass on an API path will not generate failed-login noise. If you are relying on authentication failure alerts to spot attacks against ISE, you will not see this one. Look instead at request logs for the management plane and at administrative actions that no one on your team can account for.

The CISA requirement

CISA’s required action is to apply the vendor’s mitigations in line with BOD 26-04, and to follow CISA’s forensics triage requirements [1]. Where mitigations are not available, the directive’s instruction is to discontinue use of the product [1]. BOD 26-04 also sets basic expectations for when agencies must check whether the system was compromised before the patch was applied, rather than patching and moving on [2].

BOD 26-04 binds only federal civilian executive branch agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and prioritise KEV entries [2]. For a pre-auth flaw with a three-day federal deadline, that advice is worth taking literally.

What to do

• Read Cisco’s advisory for CVE-2026-76460 and identify the fixed release for each of your ISE and ISE-PIC deployment trains. The sources here do not name versions, so the vendor advisory is the authoritative input.
• Patch or apply Cisco’s stated mitigations now. The federal deadline was 19 September 2026 [1]; exploitation is already occurring [2][3].
• Confirm that no ISE or ISE-PIC management interface or API is reachable from the internet. If one is, restrict it to a management network or jump host immediately, before and in addition to patching.
• Check whether the appliance was compromised before the patch was applied — the check BOD 26-04 sets expectations for in federal environments [1][2]. Review administrator accounts, newly created local accounts, changes to authorisation policies and network device group membership, certificate and repository configuration, and any backup or export jobs you did not schedule.
• Rotate ISE administrative credentials, API keys, RADIUS/TACACS+ shared secrets and any integration credentials stored on the appliance if you find evidence of access — and consider doing so regardless, given the impact profile in the published vector.
• Preserve logs before reimaging or upgrading. Upgrades can rotate or truncate the evidence you would need later.
• If you run Acronis Backup, review CVE-2026-87886 from the same KEV update as a separate item of work [2].