Under Active Attack: Cisco ISE Zero-Day (CVE-2026-76460) Grants Remote Unauthenticated Admin Access

A critical zero-day vulnerability in Cisco Identity Services Engine (ISE) is under active exploitation across enterprise perimeters worldwide. Tracked as CVE-2026-76460 and carrying a maximum CVSSv3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), this flaw enables remote, unauthenticated adversaries to bypass REST API authentication and execute administrative actions against Cisco ISE Primary Administration Nodes (PAN) and Policy Service Nodes (PSN). Because Cisco ISE acts as the central Policy Decision Point (PDP) for enterprise 802.1X network access control, RADIUS/TACACS+ AAA services, and Software-Defined Access (SD-Access) fabrics, weaponization results in total compromise of network segmentation.

Active exploitation was identified in mid-September 2026 during incident response investigations into unauthorized lateral movement within financial and defense networks. Adversaries exploited an architectural path normalization desynchronization between Cisco ISE reverse proxy filters and internal application server servlets, achieving remote administrative control without producing standard web authentication audit logs.

Threat Landscape and Exploitation in the Wild

Telemetry from managed detection and response (MDR) platforms reveals that advanced persistent threat (APT) groups began scanning for exposed Cisco ISE administrative interfaces within 48 hours of initial weaponization. Observed traffic originates primarily from bulletproof hosting infrastructure and compromised edge gateways, targeting TCP ports 8443 and 443.

The observed attack campaign follows a structured sequence:

1. Edge Reconnaissance: Adversaries probe undocumented REST API routing paths to verify whether the target PAN or PSN is vulnerable.
2. Authentication Bypass: By injecting path traversal sequences coupled with semicolon-delimited matrix parameters, attackers bypass the RestAuthFilter routine to reach internal administrative servlets.
3. Cryptographic Harvesting: The actors query External RESTful Services (ERS) configuration endpoints to export active RADIUS shared secrets, TACACS+ keys, and Active Directory service account hashes.
4. TrustSec SGT Manipulation: Attackers alter Cisco TrustSec Security Group Tag (SGT) assignments and Downloadable Access Control Lists (dACLs), granting rogue hardware addresses unrestricted network access.
5. Persistence: Attackers upload weaponized posture validation packages to plant persistent web shells within the underlying Linux filesystem.

Organizations with internet-exposed Cisco ISE administration nodes face severe, immediate risk of full network takeover.

Technical Root Cause: Proxy-to-Tomcat Path Desynchronization

The root cause of CVE-2026-76460 lies in an architectural desynchronization between Cisco ISE front-end reverse proxy tier (Apache HTTPd) and the back-end application server (Apache Tomcat hosting the core administrative web application).

When an HTTP request enters Cisco ISE on port 8443, the front-end reverse proxy evaluates the URI against an access control matrix. Endpoints categorized as public—such as guest registration portals, SAML SSO assertion endpoints, and client provisioning checks—are allowed to proceed without session tokens:

+------------------------+      Raw URI with Matrix Param       +------------------------+
|   Attacker Connection  | -----------------------------------> |   Apache HTTPd Proxy   |
|   (Client Request)     |   /api/v1/mnt;public/../../admin/    |  (Evaluates Regex Filter)
+------------------------+                                      +------------------------+
                                                                            |
                                                                            | Match: Allowed (Public)
                                                                            v
+------------------------+        Normalized Dispatch           +------------------------+
| Privileged Core Logic  | <----------------------------------- |     Apache Tomcat      |
|  (Executes as Admin)   |      /admin/networkdevice/create     | (Strips Matrix Params, |
+------------------------+                                      |  Resolves Traversals)  |
                                                                +------------------------+

The front-end proxy evaluates access control using a regular expression filter for unauthenticated prefixes:

^/(ise/guest|api/v1/public|auth/saml/sso|portal/gateway)/.*$

However, Cisco ISE routing permits URI matrix parameters (RFC 3986 path parameters separated by semicolons ;). The front-end proxy parses URI paths strictly on forward slashes /, ignoring semicolon delimiters. When an attacker sends a request structured as:

POST /api/v1/public;admin/../../api/v1/ers/config/networkdevice HTTP/1.1
Host: ise-pan.internal.corp:8443
Content-Type: application/json

{"NetworkDevice": {"name": "Rogue_Node", "authenticationSettings": {"radiusSharedSecret": "Compromised2026!"}}}

The front-end proxy matches /api/v1/public;admin/... against ^/api/v1/public.*, determining that the request belongs to an open API endpoint. It forwards the request untouched to Apache Tomcat.

When Tomcat receives the URI, its standard pipeline executes path normalization routines. Tomcat strips ;admin, evaluates the relative traversal /../../, and resolves the effective target to /api/v1/ers/config/networkdevice.

The request reaches the External RESTful Services (ERS) servlet. Because the front-end proxy attached internal forwarding headers (X-ISE-Internal-Forward: true), the back-end application server assumes upstream authentication succeeded. The request executes with full administrative privileges.

Decompiled Logic: RestAuthFilter Flaws

Decompilation of the core authentication filter com.cisco.cpm.infrastructure.rest.RestAuthFilter inside cpm-infra-rest.jar reveals the validation gap:

public class RestAuthFilter implements Filter {
    private static final String BYPASS_HEADER = "X-ISE-Internal-Forward";
    private static final Pattern PUBLIC_PATHS = Pattern.compile("^/(api/v1/public|ise/guest).*");

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String requestURI = httpRequest.getRequestURI();
        String internalHeader = httpRequest.getHeader(BYPASS_HEADER);

        // Flaw 1: Direct trust of internal proxy headers without HMAC validation
        if ("true".equalsIgnoreCase(internalHeader)) {
            chain.doFilter(request, response);
            return;
        }

        // Flaw 2: Checking URI before Tomcat canonicalization completes
        if (PUBLIC_PATHS.matcher(requestURI).matches()) {
            chain.doFilter(request, response);
            return;
        }

        HttpSession session = httpRequest.getSession(false);
        if (session == null || session.getAttribute("ADMIN_PRINCIPAL") == null) {
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "Access Denied");
            return;
        }

        chain.doFilter(request, response);
    }
}

Two implementation defects combine to create the vulnerability:

1. The proxy filter validates the raw URI string prior to Tomcat canonicalization.
2. If an external client crafts X-ISE-Internal-Forward: true directly, legacy reverse proxy configurations fail to strip the header before forwarding, allowing an immediate authentication bypass.

Figure 1: Architectural and benchmark overview for Under Active Attack: Cisco ISE Zero-Day (CVE-2026-76460) Grants Remote Unauthenticated Admin Access.

Lateral Movement Vectors and Blast Radius

Administrative control over the ISE Policy Decision Point (PDP) grants adversaries critical capabilities:

1. TrustSec Security Group Tag (SGT) Manipulation

In Cisco SD-Access and TrustSec environments, switches and Next-Generation Firewalls (NGFWs) enforce micro-segmentation based on SGT labels rather than static IP addresses. By interacting with the ERS API, an attacker modifies SGT binding tables:

• Reassigns an endpoint from SGT Employees (Tag 4) to SGT Domain_Controllers (Tag 2) or PCI_Cardholder_Data (Tag 10).
• The updated matrix distributes to hardware switches and firewalls via the Subsystem Group Tag Exchange Protocol (SXP).
• Perimeter firewalls and access switches immediately permit unfiltered Layer 3 and Layer 4 access to restricted infrastructure.

2. RADIUS/TACACS+ Credential Exfiltration

Cisco ISE stores shared secrets used to secure RADIUS authentication for 802.1X switches, wireless LAN controllers (WLCs), and VPN gateways. Leveraging the unauthenticated REST API, attackers query /ers/config/networkdevice to retrieve:

• Cleartext or reversibly encrypted RADIUS shared secrets.
• TACACS+ connection keys for core network infrastructure.
• Identity Store credentials, including Active Directory service accounts used by ISE for domain lookups.

With these credentials, adversaries can deploy rogue RADIUS clients, intercept network traffic, or compromise the Active Directory domain.

3. Web Shell Deployment via Posture Packages

Cisco ISE allows administrators to upload posture scripts and AnyConnect compliance modules. Attackers exploit this via /api/v1/posture/upload:

• The attacker uploads a crafted tarball containing a Java Server Page (JSP) web shell disguised as a posture compliance rule.
• The file unpacks into /opt/CSCOise/workspace/store/, accessible via the web server root.
• The web shell executes with ise application user privileges, which can escalate to root via local privilege escalation vectors in the underlying operating system.

Indicators of Compromise and Forensic Artifacts

Security teams should immediately inspect all Cisco ISE appliances for the forensic artifacts detailed below.

Network Indicators

• HTTP POST/PUT requests to port 8443 or 443 containing ;, %3b, ..%2f, or %2e%2e%2f in the request URI.
• Incoming HTTP requests bearing X-ISE-Internal-Forward: true from untrusted network segments.
• Administrative REST API calls originating from non-management subnets.

Host and Appliance Artifacts

Examine the following log files on all Cisco ISE nodes via administrative CLI:

# Check Tomcat access logs for matrix parameter anomalies
grep -E "(\;|\%3[bB]|\.\.\/)" /opt/CSCOise/logs/tomcat/localhost_access_log*.txt

# Inspect ERS audit logs for unexpected network device modifications
grep "ERS-AUDIT" /opt/CSCOise/logs/ers.log | grep -E "(POST|PUT|DELETE)"

Key indicators of compromise to monitor in SIEM platforms:

Detection Engineering: Snort 3 and Suricata Signatures

Deploy the following intrusion detection rules across perimeter and internal network sensors.

Snort 3 Detection Rule

alert tcp any any -> $CISCO_ISE_SERVERS [443,8443] (
    msg:"THREATFRONTIER - EXPLOIT - Cisco ISE REST API Auth Bypass (CVE-2026-76460)";
    flow:to_server,established;
    http_uri;
    content:";",nocase;
    pcre:"/\/(api|ise|portal|auth)\/[^?#]*;[^?#]*\.\.\//i";
    metadata:service http, policy balanced-ips drop;
    reference:cve,2026-76460;
    classtype:attempted-admin;
    sid:90026764;
    rev:1;
)

Suricata Detection Rule

alert http any any -> $CISCO_ISE_SERVERS [443,8443] (
    msg:"THREATFRONTIER - EXPLOIT - Cisco ISE URI Path Desync Inbound (CVE-2026-76460)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:";"; fast_pattern;
    pcre:"/^\/(api\/v1|ise\/guest|portal)\/[^\/]+;[^\/]*\/\.\.\//";
    threshold:type limit, track by_src, count 1, seconds 300;
    classtype:web-application-attack;
    reference:cve,2026-76460;
    sid:202676460;
    rev:1;
)

Immediate Mitigation and Remediation Runbook

Because CVE-2026-76460 is under active exploitation, execute immediate containment procedures:

Phase 1: Perimeter and Ingress Isolation

1. Enforce Out-of-Band Management: Block all external access to TCP ports 8443, 443, and 8905 on all Cisco ISE appliances. Restrict administrative access to dedicated management jump hosts via isolated VLANs.
2. WAF Rule Deployment: If Cisco ISE interfaces must remain accessible across routed networks, implement a WAF inspection rule dropping incoming HTTP requests containing semicolons (; or %3b) or path traversal sequences (.. or %2e%2e) in the URI path.

Phase 2: Disable External RESTful Services (ERS)

If ERS is not required for daily provisioning workflows, disable it globally:

1. In Cisco ISE GUI, navigate to Administration > System > Settings > ERS Settings.
2. Set ERS Components to Disable and save the configuration.

Phase 3: Patch Application & Post-Incident Verification

Apply the emergency vendor patch released by Cisco:

• Cisco ISE 3.4: Apply Patch 1 (3.4.0.001) or hotfix ise-3.4-hotfix-cve-2026-76460.tar.gz.
• Cisco ISE 3.3: Apply Patch 3 Hotfix 1.
• Cisco ISE 3.2: Apply Patch 6 Hotfix 2.
• Cisco ISE 3.1: Upgrade to a supported, patched major release immediately; version 3.1 is End of Software Maintenance.

Audit all Network Device entries, SGT mappings, and administrative accounts to verify no unauthorized changes occurred prior to remediation.