# CVE-2026-76460: Cisco ISE CVSS 10.0 Auth Bypass Under Active Exploitation — Patch Now

> Cisco ISE CVE-2026-76460 is a CVSS 10.0 authentication bypass under active exploitation with no workaround. Affected versions, patches, compromise detection, and what to do right now.

Source: https://playciso.com/blog/cve-2026-76460-cisco-ise-cvss-10-auth-bypass-active-exploitation · Published: 2026-09-17 · Publisher: PlayCISO (https://playciso.com)

---

On September 16, 2026, Cisco disclosed **CVE-2026-76460**, a CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) that is **already under active exploitation**. There is no workaround. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of September 19 — three days from disclosure. If your organization runs ISE for network access control, 802.1X, or RADIUS, this is a stop-what-you're-doing vulnerability. ## What CVE-2026-76460 does The flaw is an insufficient authentication control on an API endpoint in Cisco ISE and ISE Passive Identity Connector (ISE-PIC). An unauthenticated remote attacker can send a crafted request to the vulnerable endpoint, bypass authentication entirely, and **execute arbitrary commands as root** on the ISE node. No credentials are needed. No user interaction is required. The attack complexity is low. In CVSS 3.1 terms, this is as bad as a network vulnerability gets: MetricValue Attack VectorNetwork Attack ComplexityLow Privileges RequiredNone User InteractionNone ScopeChanged Confidentiality / Integrity / AvailabilityHigh / High / High **CVSS Score****10.0 (Critical)** ISE is the policy engine that decides who and what gets on your network. Root compromise of ISE means an attacker can modify access policies, pivot to any network segment ISE controls, extract RADIUS shared secrets, and establish persistence at the infrastructure layer where endpoint detection tools have no visibility. ## Affected versions and patches Every supported ISE release has a fix available. ISE 3.0 and earlier are end-of-life and receive no patch — those must be migrated. ISE VersionFixed ReleaseStatus 3.0 and earlierNoneEnd-of-life — migrate to 3.1+ 3.13.1P12Available 3.23.2P11Available 3.33.3P12Available 3.43.4P7Available 3.53.5P4Available Cisco has confirmed there is **no workaround**. No ACL, no configuration change, no disable-the-API flag. Patching is the only remediation. ## How to detect exploitation Cisco's advisory includes a specific detection step. From the ISE admin CLI: `admin# show logging application ise-kong/access.log | include dummyuser` Any entries containing `dummyuser` indicate exploitation attempts against the vulnerable API endpoint. The string appears in the attacker's crafted request and is logged by ISE's API gateway (Kong) before the authentication bypass takes effect. **If you find hits: the node is compromised.** Patching a compromised node is not sufficient. The attacker had root access and may have installed persistence mechanisms, modified ISE configuration, extracted credentials, or tampered with logs. The correct response is: - Isolate the ISE node from the network - Capture forensic data (logs, disk image) before remediation - Re-image the node from a known-good backup or fresh install - Apply the patched release before reconnecting - Rotate all RADIUS shared secrets, TACACS+ keys, and any certificates stored on the node - Audit ISE policy changes for unauthorized modifications ## Timeline DateEvent Sep 16, 2026Cisco publishes advisory; active exploitation confirmed Sep 16, 2026CISA adds to KEV catalog Sep 19, 2026CISA federal remediation deadline A three-day CISA deadline is exceptional. The typical KEV deadline is 21 days. Three days signals that exploitation is not theoretical — it is widespread enough that CISA considers unpatched federal systems an immediate risk. ## What to do right now - Identify every ISE node in your environment — production, lab, disaster recovery, forgotten dev instances. The attack surface is any ISE node reachable over the network. - Run the detection command on every node: show logging application ise-kong/access.log | include dummyuser - If clean: patch immediately to the fixed release for your version (see table above). Don't wait for a maintenance window — the CISA deadline is September 19. - If compromised: isolate, image, re-image. Forensics first, then fresh install with the patched release, then credential rotation. - If running ISE 3.0 or earlier: migrate. There is no patch and there will not be one. - Patch the rest of the September cluster — 41 ISE CVEs and 28 Secure Firewall CVEs shipped in the same cycle. The fixed releases cover them all. ## Bigger picture: which vendors produce the most CVSS 10.0s? CVE-2026-76460 is part of a pattern. Cisco shipped 77 CVEs in the same September cycle — 41 affecting ISE, 28 affecting Secure Firewall — and multiple others scored CVSS 10.0. We built a **vendor ranking table of CVSS 10.0 vulnerabilities by count and exploitability** across 12 major infrastructure vendors, with board-ready framing for CISOs, as a companion piece: [CVSS 10.0 Vendor Ranking: Who Ships the Most Critical Vulnerabilities?](/blog/cvss-10-vendor-ranking-exploitability-2026) ## Frequently asked questions **What is CVE-2026-76460?** CVE-2026-76460 is a critical authentication bypass vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). It has a CVSS score of 10.0, the maximum possible severity. An unauthenticated remote attacker can exploit it to bypass authentication on an API endpoint and execute arbitrary commands as root on the affected device. **Which Cisco ISE versions are affected?** All Cisco ISE versions prior to the patched releases are affected: 3.0 and earlier (end-of-life, must migrate), 3.1 (patch to 3.1P12), 3.2 (patch to 3.2P11), 3.3 (patch to 3.3P12), 3.4 (patch to 3.4P7), and 3.5 (patch to 3.5P4). **Is there a workaround?** No. Cisco has confirmed there is no workaround for this vulnerability. The only mitigation is applying the software update to a fixed release. **How do I detect exploitation?** Run `show logging application ise-kong/access.log | include dummyuser` from the ISE admin CLI. Any entries containing "dummyuser" indicate exploitation attempts. If found, the node should be considered compromised and re-imaged, not just patched. **What is the CISA KEV deadline?** CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog on September 16, 2026, with a remediation deadline of September 19, 2026 — three days, reflecting active exploitation.