Cisco ISE CVE-2026-76460 (CVSS 10.0) is exploited in the wild and on CISA KEV. Fixed releases for ISE and ISE-PIC, no workarounds, and Cisco's dummyuser log check.
Correction (2026-10-07): The original version of this article gave wrong fixed-release versions, quoted a hotfix filename that Cisco has not published, and described a root cause (a proxy-to-Tomcat path desynchronization, a regex, a sample request and decompiled code) that Cisco has not disclosed. It also attributed the attacks to named groups and sectors without a source. Those claims have been removed. The patch table below is taken from Cisco's advisory.
Cisco has patched a critical authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), tracked as CVE-2026-76460, and says it is being exploited in the wild. Cisco rates it CVSS 3.1 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Per Cisco, an unauthenticated, remote attacker can send a crafted request to an API endpoint and gain unauthorized access, including root-level privileges on the device. The weakness is listed as CWE-648, Incorrect Use of Privileged APIs.
Cisco ISE is the policy decision point for many networks' 802.1X access control and RADIUS/TACACS+ AAA, so a compromised node is a serious problem for any organization that runs it.
What is confirmed
| Item | Detail | Source |
|---|---|---|
| Affected products | Cisco ISE and ISE-PIC, releases 3.0 through 3.5, regardless of device configuration | Cisco advisory, Help Net Security |
| Cause (as stated by Cisco) | "Insufficient authentication control on an API endpoint" | Cisco advisory |
| Attack | Unauthenticated, remote, via a crafted request to the API | Cisco advisory |
| Exploitation | Cisco says threat actors are exploiting it in the wild | Cisco advisory |
| Disclosure | Cisco published the advisory on 2026-09-16 at 16:00 GMT (v1.0); it found the flaw while resolving a TAC support case | Cisco advisory |
| CISA KEV | Added the same day, 2026-09-16, with a federal due date of 2026-09-19 (three days). KEV marks forensic triage as required under BOD 26-04 and known ransomware campaign use as "Unknown" | CISA KEV catalog |
| Workarounds | None | Cisco advisory |
What is not public
Cisco has not published which endpoint is affected, the request that triggers the flaw, who is exploiting it, or which sectors have been hit. Any write-up that names an actor, a victim sector, a specific URL path or an exploit request is either inference or unsourced. We will add facts here when Cisco or a researcher publishes them.
Cisco warns that, because successful exploitation grants elevated access, attackers may delete evidence on the appliance. Cisco's guidance is to cross-check network and firewall logs outside ISE for unusual outbound traffic from affected nodes.
Fixed releases
Cisco says there are no workarounds. Upgrade to the first fixed release for your train:
| ISE / ISE-PIC release | Fixed in |
|---|---|
| 3.5 | Patch 4 |
| 3.4 | Patch 7 |
| 3.3 | Patch 12 |
| 3.2 | Patch 11 |
| 3.1 | Patch 12 |
| 3.0 | End of software maintenance: migrate to a supported, fixed release |
What to do now
- Patch first. Install the fixed patch for your release on every ISE and ISE-PIC node. Because there is no workaround, patching is the only fix.
- Restrict management traffic while you patch. Cisco lists infrastructure access control lists that limit management traffic to ISE devices as a temporary measure until the patch is applied. This reduces exposure; it does not fix the flaw.
- Check for the indicator Cisco published. Cisco's advisory gives this command to look for suspicious usernames:
admin#show logging application ise-kong/access.log | include dummyuser. Run the check on every node in a distributed deployment. Older logs are in a support bundle created with debug logs included and shared-key encryption, at./ise/logs/apigateway/access.log.*.gz. If malicious activity is suspected, Cisco "strongly recommended to re-image the affected nodes and restore from configuration backup if needed". - Look outside the appliance. Review firewall and network logs for unexpected uploads to external addresses or downloads from malicious ones, since logs on a compromised node may have been altered.
- Audit configuration. After patching, review network device entries, authorization policies and administrator accounts for changes you did not make. This is a precaution; Cisco has not said what attackers change.
Cisco's perimeter products have faced a run of these: Cisco patched a critical SD-WAN Controller and Manager zero-day too, and Arista's CVSS 10.0 VeloCloud Orchestrator zero-day called for the same urgency. Security appliances have also been used for ransomware before, as with Interlock ransomware exploiting a critical Cisco FMC flaw, though KEV lists ransomware use for this CVE as "Unknown".
Fixed releases for CVE-2026-76460; there is no workaround.
Sources
- Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5
- Help Net Security, 2026-09-17: Cisco ISE vulnerability exploited (CVE-2026-76460)
- CISA Known Exploited Vulnerabilities catalog (entry added 2026-09-16)