Cisco released security updates to address a critical severity vulnerability in Cisco Identity Services Engine. Tracked as CVE-2026-76460, successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to bypass authentication. Cisco mentioned in their advisory that they are aware of active exploitation of this vulnerability.
CISA acknowledged the active exploitation of the vulnerability by adding to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch it before September 19, 2026.
Cisco Identity Services Engine (ISE) is a network security system that helps ensure that only trusted users and devices can access network resources. ISE is a standard policy engine that enables endpoint access control and network device administration.
Vulnerability Details
This vulnerability stems from insufficient authentication controls on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. Upon successful exploitation, an attacker could gain unauthorized access to the affected device by bypassing the web-based management interface.
Indicators of Compromise
To confirm any attempts to exploit this vulnerability, users can review the access.log and look for suspicious usernames. If the device is part of a distributed deployment, review the logs of each node. The following is a non-exhaustive example of how a suspicious username could be detected in the logs:
admin#show logging application ise-kong/access.log | include dummyuser
To view additional access.log files, collect a support bundle with include debug logs selected, use shared key encryption, and then decrypt and find the access logs at ./ise/logs/apigateway/access.log..gz.
Affected and Patched Versions
The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
| Cisco ISE or ISE-PIC Release | First Fixed Release |
|---|---|
| 3.1 | 3.1 Patch 12 |
| 3.2 | 3.2 Patch 11 |
| 3.3 | 3.3 Patch 12 |
| 3.4 | 3.4 Patch 7 |
| 3.5 | 3.5 Patch 4 |
Note: Cisco ISE Software Release 3.0 has reached End of Software Maintenance. Users must upgrade to migrate to a supported release that includes the fix for this vulnerability.
For more information, please refer to Cisco Security Advisory (cisco-sa-ISE-ABP-VNSW7Tn5).
Qualys Detection
Qualys customers can scan their devices with QID 317886 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References
