Cisco ISE Zero-Day CVE-2026-76460 Hands Attackers Root on Your Network Policy Engine

TL;DR

What: Cisco disclosed CVE-2026-76460, a CVSS 10.0 authentication bypass on an Identity Services Engine API endpoint that is already under active exploitation.

Cisco confirmed on September 17, 2026 that attackers are actively exploiting CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine. A single crafted request to an affected API endpoint gets an unauthenticated remote attacker past the web based management interface, and Cisco states that successful exploitation can yield command execution with root privileges. CISA added the CVE to the Known Exploited Vulnerabilities catalog on September 16 and set the federal civilian remediation deadline at September 19, a three day window that tells you how the agency reads the risk.

Why root on ISE is worse than root on most boxes

ISE is not an edge appliance you can shrug off. It is the policy decision point for 802.1X, MAB, guest onboarding, posture assessment, and TACACS+ device administration. An attacker with root on it can author authorization policy, issue themselves network access that every switch and wireless controller in the estate will honor, read RADIUS shared secrets and certificate material, and reach the Active Directory integration account ISE uses for identity lookups. Compromise of the authentication authority converts into quiet, credentialed access everywhere downstream, and it looks like normal policy from the switch side.

The root cause is insufficient authentication control on an API endpoint. Cisco says the flaw affects Cisco ISE and Cisco ISE Passive Identity Connector regardless of device configuration, so there is no hardened build, no feature toggle, and no deployment model that escapes it. Cisco has not described the attacks or named an actor.

No workaround exists

Cisco is explicit that there is no workaround. The only stopgap is an infrastructure ACL that permits management and control plane traffic to the appliance from required sources only. That shrinks who can reach the endpoint, it does not close the hole. Patching is the fix.

Fixed releases

ISE 3.1: fixed in 3.1 Patch 12
ISE 3.2: fixed in 3.2 Patch 11
ISE 3.3: fixed in 3.3 Patch 12
ISE 3.4: fixed in 3.4 Patch 7
ISE 3.5: fixed in 3.5 Patch 4

Patch every node in a distributed deployment, not just the primary admin node. Policy Service Nodes and Monitoring nodes run the same code and expose the same interface. A partially patched cube leaves the attacker an unpatched entry point that still speaks to the rest of the deployment as a trusted peer.

Hunt before you patch, not after

Because exploitation ends at root, Cisco warns that evidence of exploitation and indicators of compromise may be removed or hidden by the threat actor. Patching an already compromised node upgrades the software and leaves the intruder in place. Run the compromise check first, on every node, and capture the output somewhere off the appliance. Cisco's published indicator is suspicious usernames in the Kong API gateway access log.

show logging application ise-kong/access.log | include dummyuser
show logging application ise-kong/access.log | include admin
show version

Cisco's guidance is direct: the presence of any entry in that first command's output likely points to malicious activity. Do not treat a clean result on the primary admin node as a clean deployment. Repeat the check node by node, and pull the raw access.log to a collector so the evidence survives anything the attacker does next.

A hit means re-image, not remediate

If you find unexpected usernames, Cisco's instruction is to re-image the affected nodes and restore from configuration backup if needed. Treat every credential and secret stored on that node as disclosed: RADIUS shared secrets, TACACS keys, the AD join account, admin passwords, and any certificate private keys held on the appliance.

This was not a single advisory

CVE-2026-76460 landed inside a bundle of 77 new CVEs published the same Wednesday. Of those, 41 affect ISE and 28 affect the Secure Firewall portfolio. Cisco describes part of the set as hardening measures from an ongoing internal review, which is the vendor telling you the product line is under sustained scrutiny and more is coming. The items worth pulling out of the pile:

CVE-2026-76423 (CVSS 10.0) plus CVE-2026-76424 through CVE-2026-76428: REST API authentication bypass, remote code execution, SQL injection, and XML External Entity injection in ISE and ISE-PIC.
CVE-2026-20130 and CVE-2026-20192, both CVSS 10.0, alongside CVE-2026-20234 and CVE-2026-20237 at 9.9: command injection, authentication or authorization bypass, and information disclosure in ISE and ISE-PIC.
CVE-2026-20176 (9.9), CVE-2026-20305 and CVE-2026-20306 (9.1): authenticated arbitrary command execution as root on ISE, exploitable by anyone holding valid administrative credentials, which is exactly what CVE-2026-76460 gives an attacker.
CVE-2026-20322, CVE-2026-20325 (both 9.9) and CVE-2026-20326 (9.8): command injection and auth bypass in Cisco Nexus Dashboard.
CVE-2026-76412, CVE-2026-76413 and CVE-2026-76420 (9.0): root access and session forgery in Secure Firewall Management Center, plus a grouped set of ASA, FTD and FMC issues from CVE-2026-20329 to CVE-2026-20336.
CVE-2026-76461 (9.8): AsyncOS for Cisco Secure Email Gateway, confirmed under active exploitation days earlier.

The chaining risk is the part to brief upward. CVE-2026-76460 hands over administrative access without credentials. Several of the authenticated command injection bugs in the same release then convert that access into root code execution through a supported path that generates ordinary looking admin activity. Patching the zero-day alone while deferring the authenticated RCE fixes to the next maintenance window leaves the second half of the chain intact.

The next 48 hours

Inventory every ISE and ISE-PIC node, including lab, DR, and the Passive Identity Connectors people forget they deployed. Record the exact patch level per node.
Run the access.log check on all nodes and export the results off box before touching anything else.
Apply the fixed patch for your train. If a maintenance window is genuinely impossible today, put an iACL in front of the management interface now and treat it as temporary containment.
Forward ise-kong access logs and ISE administrative audit events to the SIEM if they are not already there. You cannot alert on a log that never leaves the appliance.
Plan credential rotation for anything stored on ISE. If you find an indicator, rotation is not optional and re-image comes first.

The limit on detection here is real: an attacker with root can edit or delete the very log Cisco points you at, so an empty result proves less than it appears to. Weigh it alongside network telemetry, upstream firewall logs of who reached the admin interface, and any unexplained authorization policy changes. Patch on the assumption you are late.

Fix It Yourself

Everything above is what happened. This is what to run. The check commands change nothing.

Check whether you are exposed

Check the patch level of an ISE node against the fixed releases (read only)

ssh [email protected] 'show version'

Cisco's published IoC: look for unexpected usernames in the Kong API access log, run on every node

ssh [email protected] 'show logging application ise-kong/access.log | include dummyuser'

List which hosts can currently reach an ISE admin interface on 443 from this segment (no change made)

nc -z -w3 ise-node.example.com 443 && echo REACHABLE_FROM_HERE

Close it

Install the fixed patch bundle downloaded from Cisco (3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7, 3.5 P4) from a configured repository

ssh [email protected] 'patch install <cisco-patch-bundle-filename> <repository-name>'

Containment only while you schedule the patch: restrict management plane access to ISE on the upstream router with an iACL

ip access-list extended ISE-MGMT-IACL
 permit tcp host 10.0.0.0 0.0.0.255 host <ise-ip> eq 443
 deny tcp any host <ise-ip> eq 443 log
 permit ip any any

Preserve configuration before a re-image if you found an IoC hit (backup, deletes nothing)

ssh [email protected] 'backup ise-preimage-backup repository <repository-name> ise-config encryption-key plain <key>'

Prompts for the agent you already run

Paste this when you need to know, fast, which ISE nodes in your estate are unpatched and whether any show Cisco's indicator of compromise.

I need a triage of my Cisco ISE fleet for CVE-2026-76460. Read my inventory source (ask me for the path if you cannot find one, do not guess hostnames). For each ISE and ISE-PIC node, SSH in and run exactly two read only commands: 'show version' and 'show logging application ise-kong/access.log | include dummyuser'. Save the raw output per node to a local file under ./ise-triage/ and show me every command you run and its output. Then build a table of node, version, patch level, whether it meets the fixed release (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4), and whether the IoC check returned any lines. Do not install patches, do not restart services, do not modify any appliance configuration. Stop and report when the table is complete.

Paste this when you want detection coverage built before or alongside the patching work.

Build me a detection for Cisco ISE CVE-2026-76460 exploitation in my SIEM. First tell me which SIEM and log sources you can see and confirm whether ise-kong access.log and ISE administrative audit events are already being ingested, showing the searches you ran to determine that. Then write, but do not deploy, a detection rule that alerts on: any username in the ise-kong access.log that is not in my known administrator list, any successful admin authentication to ISE from a source outside my management subnets, and any ISE authorization policy or admin account change not tied to a change ticket. Show me the rule text and the expected false positive sources. Stop before enabling or saving anything to production, and do not delete or edit existing rules.

What to alert on

The single highest value observable is the username field in the Cisco ISE Kong API gateway access log, ise-kong/access.log, which Cisco itself names as the IoC source for CVE-2026-76460. Forward that log off the appliance via ISE remote logging targets and alert on any username value that is not on an allowlist of your provisioned administrator accounts, with Cisco's own example value dummyuser as an immediate high severity trigger. Pair it with two supporting signals, because a root level attacker can edit that log: first, successful administrative authentication events in the ISE Operations Audit log where the source IP falls outside your management subnets, and second, any ISE administrative configuration change event covering authorization policy, admin account creation, or repository definition that does not correlate to an approved change record. On the network side, alert on any source outside the management subnets completing a TCP session to the ISE admin interface on port 443 in your upstream firewall or iACL deny logs, since with no workaround available that reachability is the precondition for the entire attack.

Questions about your exposure?

RedEye Security provides assessments for organizations that need to understand their real risk.

Talk to us