CVE-2026-76460: Cisco Identity Services Engine Authentication Bypass (KEV)

CVE-2026-76460 is an authentication-bypass flaw in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC that lets a remote, unauthenticated attacker bypass the web-based management interface and gain unauthorized access to the device, and Cisco PSIRT has confirmed this is being actively exploited.

CVE-2026-76460 is an authentication bypass using an alternate path or channel in an API of Cisco Identity Services Engine (ISE) Software, also affecting ISE Passive Identity Connector (ISE-PIC). Cisco's advisory states the flaw "is due to insufficient authentication control on an API endpoint," and that "an attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint," with a successful exploit allowing "the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface" (Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5).

NVD's record for this CVE is Analyzed, but NVD has not published its own independent Primary CVSS score; the only metric on record is the reporting Cisco PSIRT's Secondary rating of CVSS v3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). So the 10.0 shown here is Cisco's own CNA Secondary score, not an NVD-confirmed Primary score (NVD).

Cisco's advisory states "the Cisco PSIRT is aware of active exploitation of this vulnerability" and that "there are no workarounds that address this vulnerability." Cisco notes ISE release 3.0 has reached end of software maintenance and recommends migrating to a supported release; for affected releases, Cisco's only mitigation short of patching is using infrastructure access control lists to restrict management-plane traffic to trusted sources (Cisco Security Advisory).

CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16, with a required-action due date of 2026-09-19; the catalog records known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.756 (99.5th percentile), consistent with Cisco's own confirmation of in-the-wild attacks (FIRST EPSS).

Any Cisco ISE or ISE-PIC deployment on an affected release, especially one with its admin/API surface reachable from untrusted networks, should be patched to the fixed release for its branch immediately; since no workaround exists, restricting management-plane access with infrastructure ACLs only reduces exposure, it does not remove the vulnerability.

• Insufficient authentication control on an ISE/ISE-PIC API endpoint lets an unauthenticated remote attacker send a crafted request to bypass the web-based management interface and gain unauthorized device access. — Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5
• CVSS v3.1 base score is 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — the reporting Cisco PSIRT's Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Cisco PSIRT is aware of active exploitation; no workarounds exist; affected: ISE/ISE-PIC 3.1 before Patch 12, 3.2 before Patch 11, 3.3 before Patch 12, 3.4 before Patch 7, 3.5 before Patch 4; release 3.0 is end-of-life. — Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-16, required-action due date 2026-09-19, ransomware campaign use recorded as Unknown. — CISA KEV
• EPSS score is 0.756 (99.5th percentile) as of 2026-10-28. — FIRST EPSS