CVE-2026-76460: Cisco ISE CVSS 10.0 Auth Bypass Under Active Exploitation — Patch Now
CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) that is under active exploitation as of September 2026. There is no workaround — the only remediation is patching to ISE 3.1P12, 3.2P11, 3.3P12, 3.4P7, or 3.5P4. ISE 3.0 is end-of-life and must be migrated. CISA added it to the Known Exploited Vulnerabilities catalog on September 16 with a federal deadline of September 19. Exploitation gives an unauthenticated attacker root-level command execution on the ISE node. Detection involves checking ise-kong/access.log for requests containing "dummyuser." Compromised nodes should be re-imaged, not just patched.
On September 16, 2026, Cisco disclosed CVE-2026-76460, a CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) that is already under active exploitation. There is no workaround. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of September 19 — three days from disclosure. If your organization runs ISE for network access control, 802.1X, or RADIUS, this is a stop-what-you're-doing vulnerability.
What CVE-2026-76460 does
The flaw is an insufficient authentication control on an API endpoint in Cisco ISE and ISE Passive Identity Connector (ISE-PIC). An unauthenticated remote attacker can send a crafted request to the vulnerable endpoint, bypass authentication entirely, and execute arbitrary commands as root on the ISE node. No credentials are needed. No user interaction is required. The attack complexity is low.
In CVSS 3.1 terms, this is as bad as a network vulnerability gets:
| Metric | Value |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Changed |
| Confidentiality / Integrity / Availability | High / High / High |
| CVSS Score | 10.0 (Critical) |
ISE is the policy engine that decides who and what gets on your network. Root compromise of ISE means an attacker can modify access policies, pivot to any network segment ISE controls, extract RADIUS shared secrets, and establish persistence at the infrastructure layer where endpoint detection tools have no visibility.
Affected versions and patches
Every supported ISE release has a fix available. ISE 3.0 and earlier are end-of-life and receive no patch — those must be migrated.
| ISE Version | Fixed Release | Status |
|---|---|---|
| 3.0 and earlier | None | End-of-life — migrate to 3.1+ |
| 3.1 | 3.1P12 | Available |
| 3.2 | 3.2P11 | Available |
| 3.3 | 3.3P12 | Available |
| 3.4 | 3.4P7 | Available |
| 3.5 | 3.5P4 | Available |
Cisco has confirmed there is no workaround. No ACL, no configuration change, no disable-the-API flag. Patching is the only remediation.
How to detect exploitation
Cisco's advisory includes a specific detection step. From the ISE admin CLI:
admin# show logging application ise-kong/access.log | include dummyuserAny entries containing dummyuser indicate exploitation attempts against the vulnerable API endpoint. The string appears in the attacker's crafted request and is logged by ISE's API gateway (Kong) before the authentication bypass takes effect.
If you find hits: the node is compromised. Patching a compromised node is not sufficient. The attacker had root access and may have installed persistence mechanisms, modified ISE configuration, extracted credentials, or tampered with logs. The correct response is:
- Isolate the ISE node from the network
- Capture forensic data (logs, disk image) before remediation
- Re-image the node from a known-good backup or fresh install
- Apply the patched release before reconnecting
- Rotate all RADIUS shared secrets, TACACS+ keys, and any certificates stored on the node
- Audit ISE policy changes for unauthorized modifications
Timeline
| Date | Event |
|---|---|
| Sep 16, 2026 | Cisco publishes advisory; active exploitation confirmed |
| Sep 16, 2026 | CISA adds to KEV catalog |
| Sep 19, 2026 | CISA federal remediation deadline |
A three-day CISA deadline is exceptional. The typical KEV deadline is 21 days. Three days signals that exploitation is not theoretical — it is widespread enough that CISA considers unpatched federal systems an immediate risk.
What to do right now
- Identify every ISE node in your environment — production, lab, disaster recovery, forgotten dev instances. The attack surface is any ISE node reachable over the network.
- Run the detection command on every node:
show logging application ise-kong/access.log | include dummyuser - If clean: patch immediately to the fixed release for your version (see table above). Don't wait for a maintenance window — the CISA deadline is September 19.
- If compromised: isolate, image, re-image. Forensics first, then fresh install with the patched release, then credential rotation.
- If running ISE 3.0 or earlier: migrate. There is no patch and there will not be one.
- Patch the rest of the September cluster — 41 ISE CVEs and 28 Secure Firewall CVEs shipped in the same cycle. The fixed releases cover them all.
Bigger picture: which vendors produce the most CVSS 10.0s?
CVE-2026-76460 is part of a pattern. Cisco shipped 77 CVEs in the same September cycle — 41 affecting ISE, 28 affecting Secure Firewall — and multiple others scored CVSS 10.0. We built a vendor ranking table of CVSS 10.0 vulnerabilities by count and exploitability across 12 major infrastructure vendors, with board-ready framing for CISOs, as a companion piece: CVSS 10.0 Vendor Ranking: Who Ships the Most Critical Vulnerabilities?
Frequently asked questions
What is CVE-2026-76460? CVE-2026-76460 is a critical authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). It has a CVSS score of 10.0, the maximum possible severity. An unauthenticated remote attacker can exploit it to bypass authentication on an API endpoint and execute arbitrary commands as root on the affected device.
Which Cisco ISE versions are affected? All Cisco ISE versions prior to the patched releases are affected: 3.0 and earlier (end-of-life, must migrate), 3.1 (patch to 3.1P12), 3.2 (patch to 3.2P11), 3.3 (patch to 3.3P12), 3.4 (patch to 3.4P7), and 3.5 (patch to 3.5P4).
Is there a workaround? No. Cisco has confirmed there is no workaround for this vulnerability. The only mitigation is applying the software update to a fixed release.
How do I detect exploitation? Run show logging application ise-kong/access.log | include dummyuser from the ISE admin CLI. Any entries containing "dummyuser" indicate exploitation attempts. If found, the node should be considered compromised and re-imaged, not just patched.
What is the CISA KEV deadline? CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, with a remediation deadline of September 19, 2026 — three days, reflecting active exploitation.
Ready to practise the decisions these articles describe?
Run a free War Room →