On September 16, Cisco published an advisory for CVE-2026-76460, a Cisco ISE authentication bypass vulnerability in an API endpoint, with active exploitation confirmed in the wild. It received the maximum severity CVSS score of 10.0, largely because an unauthenticated attacker can make one request to that endpoint and get past the web-based management interface. What’s more, successful exploitation may yield command execution with root privileges. Most appliance bugs we brief clients on sit at the edge and hand an attacker a foothold. This one sits at the center and hands an attacker the rules.

What the Bypass Actually Buys an Attacker

This particular vulnerability has been filed under CWE-648, meaning it was classified as a software weakness because there is insufficient authentication control on an API endpoint. No brute force or stolen credentials necessary: Because this is an unauthenticated API bypass, the authentication layer in front of ISE administration stops mattering.

Severity comes from what ISE controls: 

• 802.1X Authentication: The industry standard protocol used to verify device identities before granting access to the physical or wireless network.
• VLAN Assignment: Virtual Local Area Network, which dictates which isolated, secure zone of the corporate network a connected laptop or server gets placed into.
• Downloadable ACLs: Access Control Lists, or the precise firewall rule sets applied directly to a device to limit what it can talk to.
• Guest & VPN Posture: Managing guest Wi-Fi access and verifying that remote devices connecting via Virtual Private Network meet health and security rules.

Gaining root access on that server means an attacker can rewrite authorization policy, read session and credential data, and delete the records that would have shown any trace of their activity. Cisco makes the same point in its indicators-of-compromise guidance: because exploitation can yield root privileges, evidence on the appliance may be removed or hidden. That is the part worth sitting with. Every segment ISE governs inherits whatever the intruder decides.

A TAC Case and a 3-Day Clock

Cisco names its own source in the advisory. The vulnerability was found during the resolution of a Cisco Technical Assistance Center support case. A bug that surfaces through customer support means a production environment was already in trouble before the advisory existed, before a patch existed, and before anyone had a detection to write.

The CISA KEV entry went up on September 16, with a federal remediation deadline of September 19. Just three days. Federal deadlines do not bind private organizations, but the length of that fuse tells you how critical CISA considers the risk. The CVE arrived inside a larger September 16 Cisco release that included separate ISE hardening, and performing a full upgrade covers both. However, because this specific vulnerability has confirmed attacks occurring right now, it dictates the emergency patching timeline.

Who Is Exposed

Cisco states the vulnerability affects ISE and ISE-PIC regardless of device configuration. There is no feature you can disable or setting you can adjust that takes you out of scope. Fixed software releases exist across the 3.1 through 3.5 trains. However, ISE 3.0 has reached end of software maintenance and will not receive a fix, so those deployments need an immediate migration plan rather than patching.

Your organizational exposure comes down to who can reach the management interface. Plenty of mid-market deployments put ISE administration on a management VLAN and call it done. That adds a layer of defense, but it is not isolation. If a compromised workstation, a flat segment, or a jump host can route to the admin interface, an attacker can launch the exploit.

What To Do This Week

• Patch to the fixed release for your train: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Cisco states there is no workaround.
• Treat iACLs as mitigation, not remediation. Cisco's stopgap recommendation is to apply infrastructure access control lists, permitting only required management and control plane traffic to the device. That limits who can deliver the request, but it does not remove the defect, and it should not delay patching.
• Review system logs (access.log) on every node. Cisco's guidance is to check it for suspicious usernames across each node in a distributed deployment, using the ise-kong application log. Any entry in that output may indicate malicious activity.
• Corroborate off the appliance. Because root privileges allow attackers to delete internal logs on the device itself, Cisco recommends cross-checking network and firewall logs outside the device for unexpected uploads to external addresses or downloads from malicious ones.
• Treat suspicion as compromise. If malicious activity is suspected, Cisco's own recommendation is to re-image the affected nodes and restore from configuration backup.

The Identity Plane Is a Crown-Jewel Control

The lesson here is about system category rather than criticism of a vendor. Organizations frequently categorize identity and policy infrastructure as management tooling, which quietly places it a tier below the systems it protects in patch priority, monitoring and access control. 

ISE is a crown jewel: It decides who gets on the network and what they touch afterward. It should be prioritized and handled accordingly.

Sources

Cisco. Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5, "Cisco Identity Services Engine Authentication Bypass Vulnerability." First published 16 September 2026, 16:00 GMT, Version 1.0. Cisco Bug ID CSCww39530. sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

CISA. "CISA Adds Two Known Exploited Vulnerabilities to Catalog." 16 September 2026. cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

CISA. Known Exploited Vulnerabilities Catalog, CVE-2026-76460 entry. cisa.gov/known-exploited-vulnerabilities-catalog

Help Net Security. Zeljka Zorz, "Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460)." 17 September 2026. helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460

‍

Published By: Daniel Parker, VP of Ethical Hacking, NetWorks Group

Publish Date: September 24, 2026