CVE-2026-76460 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-16

Added to CISA KEV: 2026-09-16 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE ACTION REQUIRED: This vulnerability is in the CISA KEV catalog with confirmed active exploitation. Treat as an incident response priority, not just a patching task.
INCIDENT RESPONSE FIRST: Before patching, review ISE access logs for unauthorized API access, unexpected administrative sessions, configuration changes, or unusual RADIUS/policy modifications dating back at least 30 days. Check for signs of lateral movement from ISE to connected network infrastructure.
EMERGENCY PATCHING: Upgrade Cisco ISE immediately to a fixed release as specified in Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5. Do not delay — automated exploitation is confirmed.
NETWORK ISOLATION: If immediate patching is not possible, implement emergency ACLs or firewall rules to restrict access to ISE management interfaces (TCP 443, API endpoints) to only known administrative IP ranges. Block all external/internet access to ISE management ports.
VERIFY EXPOSURE: Immediately audit whether ISE management interfaces, APIs, or guest portals are reachable from the internet using external port scanning or cloud security posture management tools.
CREDENTIAL ROTATION: If compromise is suspected or confirmed, rotate all credentials stored in or managed by ISE, including RADIUS shared secrets, TACACS+ keys, Active Directory service account passwords, and admin credentials.
MONITOR FOR IOCs: Set up alerting for unauthorized API calls to ISE endpoints, new admin account creation, certificate issuance anomalies, and policy changes. Review syslog/SIEM for anomalous ISE API traffic.
APPLY VENDOR HARDENING: After patching, review Cisco ISE hardening guide to ensure management access is restricted to out-of-band management networks and that unnecessary API endpoints are disabled.
PATCH PRIORITY: P1 — Patch within 24-48 hours for internet-exposed instances; within 72 hours for all other deployments. CISA BOD 22-01 mandates federal agencies remediate KEV vulnerabilities within 14 days maximum.

🔍 Web Intelligence (Kagi · 2026-09-16)

Summary

CVE-2026-76460 is a critical vulnerability affecting Cisco Identity Services Engine (ISE), stemming from insufficient authentication control on a REST API endpoint. This flaw is particularly significant because it allows an unauthenticated, remote attacker to bypass the web-based management interface and gain unauthorized access to the device with root-level privileges. Due to its maximum CVSS score of 10.0 and evidence of active exploitation in the wild, it represents a severe security risk to any network infrastructure utilizing affected Cisco ISE deployments.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog as of September 16, 2026 ^[2]^[4].
Threat Actors: While specific attribution to named threat actors or ransomware campaigns was not disclosed in initial reports, the exploitation is described as being leveraged by attackers in the wild ^[2].
Proof-of-Concept: Public availability of specific exploit tools is not detailed, though the ease of exploitation via crafted API requests suggests a high likelihood of automated scanning and exploitation.
Prerequisites: The attack is remote and does not require user interaction or prior authentication to the management interface ^[1]^[5].

Affected Products & Patches

Affected Products: Cisco Identity Services Engine (ISE) is the identified affected component.
Patches: Cisco has released security advisories on September 16, 2026, and strongly recommends that customers upgrade to the fixed software versions specified in the official Cisco PSIRT advisories ^[3].
Mitigations: There are no widely publicized workarounds beyond applying the vendor-provided software updates. Organizations are advised to immediately verify their deployment versions against the Cisco advisory and initiate patching protocols.

Impact

Access Capabilities: Successful exploitation grants an attacker full root-level access to the underlying operating system of the Cisco ISE device, enabling them to execute arbitrary commands, modify configurations, and compromise network security policies ^[1].
Business Risk: For internet-facing deployments, the risk is extreme, as ISE is a foundational component for network access control (NAC). Compromise allows attackers to potentially pivot deep into the corporate network, intercept traffic, manipulate authentication tokens, or completely disable access control mechanisms, posing a catastrophic risk to organizational integrity and data security.

Sources

CVE-2026-76460 (CVSS 10): Cisco ISE Flaw Exploited in the Wild
An exploited Cisco ISE vulnerability (CVE-2026-76460) allows remote root access. Patch this critical Cisco ISE vulnerability to secure networks.How the Attack Works. Tracked as CVE-2026-76460 , the flaw carries a maximum CVSS score of 10.0. The security advisory states , “This vulnerability is due t…
CVE-2026-76460 - Exploits & Severity - Feedly
The Cisco PSIRT advisory confirms that CVE-2026-76460, an unauthenticated REST API authentication bypass, carries a CVSS score of 10.0 and is being leveraged by attackers in the wild. Cisco disclosed nine vulnerabilities in its Identity Services Engine (ISE) on September 16, 2026, including multiple…
Cisco Advance Notification for Publication of September 16, 2026 ...
On September 16, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more…
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability CVE-2026-87886 Acronis Backup Incorrect Default Permissions ...
CVE-2026-76460 - Vulnerability Details - OpenCVE
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing th…

🔴 CVE-2026-76460