CVE-2026-76460

Published Sep 16, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-76460 is an authentication bypass vulnerability found in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This flaw stems from insufficient authentication control on a specific API endpoint. An unauthenticated, remote attacker can exploit this vulnerability by sending a specially crafted request to the affected API endpoint. Successful exploitation allows the attacker to bypass the web-based management interface and gain unauthorized access to the affected device. The vulnerability impacts Cisco ISE and ISE-PIC releases 3.0 through 3.5.

Description
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Source
psirt@cisco.com
NVD status
Analyzed
Products
identity_services_engine, identity_services_engine_passive_identity_connector

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Exploit added on
Sep 16, 2026
Exploit action due
Sep 19, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@cisco.com
CWE-648

Social media

Hype score
Not currently trending
  1. NØX Echo Lineage Signal: CVE-2026-76460 Entity: Cisco Identity Services Engine Authentication Bypass Lineage: Cisco PSIRT → Public security signal Relationship: - Cisco Identity Services Engine Authentication Bypass → CVE-2026-76460 → Evidence → Operational Risk [1/

    @_Why_Noot

    7 Oct 2026

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. Critical FortiMail zero‑day exploited in the wild (CVE‑2026‑104286) ↳ follow-up on: Cisco ISE Zero-Day Exploit CVE-2026-76460 Fortinet warned that attackers are exploiting a critical zero‑day in FortiMail… read more→ https://t.co/mvx6JKTNq4 #CyberSecurity #InfoSec #

    @aimicyber

    3 Oct 2026

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🚨 VIEH Security analyzed the active exploitation of Cisco Identity Services Engine (ISE) CVE-2026-76460 - a vulnerability affecting the system that controls identity and access across enterprise networks. CVE-2026-76460: CVSS: 10.0 Unauthenticated remote attacker No user

    @viehgroup

    26 Sept 2026

    398 Impressions

    2 Retweets

    7 Likes

    1 Bookmark

    1 Reply

    0 Quotes

  4. Critical zero-days in Cisco ISE (CVE-2026-76460) & Check Point Management (CVE-2026-93616) allow unauth access & RCE. Immediate patching is vital to safeguard data privacy/integrity in transit. #Cybersecurity #ZeroDay #News

    @YourAnon_irc

    23 Sept 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨 SECURITY ALERT CONFIRMED BY: Cisco PSIRT PRODUCT: Cisco Identity Services Engine (ISE) Cisco ISE Passive Identity Connector (ISE-PIC) CVE: CVE-2026-76460 CVSS: 10.0 IMPACT: Unauthenticated authentication bypass. Cisco warns successful exploitation may lead to command

    @Python_s_

    21 Sept 2026

    79 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  6. Cisco’s CVE-2026-76460 is a CVSS 10.0 authentication bypass in ISE and is already being exploited. Unauthenticated attackers can bypass access controls remotely.

    @vigil742

    21 Sept 2026

    26 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  7. Cisco warns CVE-2026-76460 (CVSS 10.0) in Identity Services Engine is under active exploit. Remote unauthenticated attackers can bypass API auth. Restrict management plane access and patch now. Intel to https://t.co/QYZjJGK4KH https://t.co/QC14eBVf0C

    @2Workly

    21 Sept 2026

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 🐦 ⚠️ Actively exploited: CISA added 3 Linux kernel bugs to KEV, incl. CVE-2025-39682 (CVSS 9.8, TLS rx path). Also under attack: Cisco ISE CVE-2026-76460 (CVSS 10.0 auth bypass) and Orkes Conductor CVE-2026-58138 RCE. Patch now. #infosec #CVE #0day

    @ita_ipo

    21 Sept 2026

    80 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. Cisco’s CVE-2026-76460 is a CVSS 10.0 auth bypass in ISE, with active exploitation confirmed. Unauthenticated attackers can reach root-level access.

    @vigil742

    21 Sept 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  10. Cisco ISE CVE-2026-76460 (CVSS 10): unauth API bypass to root. Active exploit; CISA KEV. Patch now. #cybersecurity #infosec #Cisco #ISE #KEV https://t.co/Oaj0EaoIEN

    @Caldura7

    20 Sept 2026

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. 🛡️ CYBER BULLETIN | 2026/09/20 🚨 1. Cisco ISE CVSS 10 auth bypass under active attack CVE-2026-76460 lets unauthenticated attackers bypass the management interface on Identity Services Engine and ISE-PIC. Cisco confirmed exploitation; CISA added it to KEV with a short

    @FrontieraTechIT

    20 Sept 2026

    116 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  12. 🛡️ CYBER BULLETIN | 2026/09/20 🚨 1. Cisco ISE CVSS 10 auth bypass under active attack CVE-2026-76460 lets unauthenticated attackers bypass the management interface on Identity Services Engine and ISE-PIC. Cisco confirmed exploitation; CISA added it to KEV with a short

    @FrontieraTechIT

    20 Sept 2026

    102 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. 🚨 Critical Cisco ISE vulnerability CVE-2026-76460 has a CVSS score of 10.0 and is under active exploitation. Learn about the risks and recommended actions: https://t.co/DgelLaRpVj #Cisco #CiscoISE #Cybersecurity #CVE-2026-76460 https://t.co/5C3mvM1xdd

    @stem__shop

    19 Sept 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 🚨 ALERTĂ - Vulnerabilitate exploatată activ la nivelul unor produse Cisco 🔐 CVE-2026-76460 este o vulnerabilitate critică, cu un scor CVSS v3.1 de 10.0, de tip “Incorrect Use of Privileged APIs (CWE-648)”. 👉 Citiți alerta: https://t.co/2WaRmd0jh7 #DNSC #Alert #

    @DNSC_RO

    18 Sept 2026

    72 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. Cisco ISE Zero-Day Exploit CVE-2026-76460 Cisco released urgent patches for a critical‑severity authentication bypass vulnerability in Identity Services Engine… read more → https://t.co/773y0o7072 #CyberSecurity #InfoSec #GlobalNews

    @aimicyber

    18 Sept 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. 🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: CVE-2025-32432 CVE-2025-57819 CVE-2026-48908 CVE-2026-76460 CVE-2026-85706 ..🧵👇

    @exploitgrid

    18 Sept 2026

    81 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    2 Replies

    0 Quotes

  17. 🚨 ثغرة Cisco ISE تُستغل بنشاط الآن مستوى خطر CVSS 10.0 يهدد كل الأنظمة CVE-2026-76460 تم الكشف عنها 17 سبتمبر 2026 وتستغل لتجاوز المصادقة وتنفيذ أوامر root. 🔹 10.0 أعلى تصنيف

    @glitch4techs

    18 Sept 2026

    28 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  18. 🐦 🚨 Cisco ISE auth bypass (CVE-2026-76460, CVSS 10.0) actively exploited in the wild — unauthenticated RCE as root, now in CISA KEV. Also live: Orkes Conductor unauth RCE (CVE-2026-58138, CVSS 9.8), public PoC available. Patch both now. #infosec #CVE #0day

    @ita_ipo

    18 Sept 2026

    55 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. Legacy exposure keeps paying off for attackers. CVE-2026-76460: Cisco ISE Auth Bypass Zero-Day CVE-2026-76460 is a CVSS 10 Cisco ISE zero-day under active exploitation. Patch now, restri… 🔗 Read → https://t.co/46OlP2ErSM

    @fynn_JourX

    18 Sept 2026

    65 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. 🛑 CVE-2026-76460: Cisco ISE Auth Bypass Zero-Day CVE-2026-76460 is a CVSS 10 Cisco ISE zero-day under active exploitation. Patch now, restri… 🔗 Details → https://t.co/onQEtsUCZl

    @lucasverdan

    18 Sept 2026

    79 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  21. For defenders, cve-2026-76460: cisco ise auth bypass zero-day should move fast. CVE-2026-76460 is a CVSS 10 Cisco ISE zero-day under active exploitation. Patch now, restri… 🔗 Details → https://t.co/CjN04DM9hF

    @SocXAInvaders

    18 Sept 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. Cisco ISE’de CVSS 10.0 kritik zafiyet: CVE-2026-76460 aktif istismarda, CISA KEV https://t.co/uEhc5c0JQn #8021X #CISAKEV #Cisco

    @EnvanterMedya

    18 Sept 2026

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. Cisco ISE zero-day CVE-2026-76460 is a CVSS 10.0 auth bypass giving root via an unauthenticated API call. Exploited in the wild, no workaround, and CISA federal patch deadline is Sept 19. If ISE brokers your network access, patch tonight. #ZeroDay #InfoSec #Cisco

    @infrasecserv

    18 Sept 2026

    25 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  24. CVE-2026-76460 in Cisco ISE is a critical authentication bypass (CVSS 10.0) with confirmed active exploitation. Despite a low EPSS (1%), its presence in CISA KEV means immediate attention is needed. Focus on patching or isolating affected ISE API endpoints.

    @BytesNora

    18 Sept 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)(認証なしの攻撃者がCisco ISEの管理インターフェースを回避、CVE-2026-76460が実悪用) #HelpNetSecurity (Sep 17) https://t.co/0Giv0atYBd

    @foxbook

    18 Sept 2026

    217 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. CVE-2026-76460, a CVSS 10.0 zero-day in Cisco ISE, is actively exploited and CISA KEV-listed, allowing unauthenticated root access via a crafted API request. #DFIR_Radar https://t.co/9fD3YfEUIG

    @DFIR_Radar

    18 Sept 2026

    160 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  27. 🚨 #Cisco ISE CVSS 100 Vulnerability #CVE-2026-76460: Critical Authentication Bypass and Active Exploitation Threat + Video -Prediction: 📈 0 Positive | 📉 1 Negative https://t.co/Tp1WHVCykf Educational Purposes!

    @UndercodeUpdate

    18 Sept 2026

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. 🔴 Cisco, ISE ve Secure Firewall ürünlerinde çok sayıda kritik güvenlik açığını yayınladı! • CVE-2026-76460 — CVSS 10.0: Cisco ISE authentication bypass. Kimlik doğrulaması gerektirmiyor ve aktif olarak sömürülüyor. • CVE-2026-76423 — CVSS 10.0: ISE/

    @ridvanyagli

    17 Sept 2026

    353 Impressions

    0 Retweets

    2 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  29. Attackers exploited CVE-2026-76460 (Cisco ISE API) and CVE-2026-87886 (Acronis Backup permissions) to compromise identity and backup infrastructure. TRC analysis shows how compromised identity services enabled lateral movement through unencrypted east-west traffic. #ZeroTrust

    @aviatrixtrc

    17 Sept 2026

    67 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  30. CISA added Cisco ISE CVE-2026-76460 (CVSS 10.0 API bypass), Acronis CVE-2026-87886, and Pixel CVE-2026-58704 to KEV. Patch ISE first. https://t.co/UtfjbYxz58 https://t.co/QC14eBVf0C #2workly

    @2Workly

    17 Sept 2026

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  31. Cisco ISE CVSS 10 auth bypass (CVE-2026-76460) is being exploited NOW. Unauth remote hit on management API; CISA KEV, short patch clock. If you run ISE/ISE-PIC: patch to fixed 3.x builds today and hunt access.log. #CyberSecurity #CVE #ZeroDay Link: https://t.co/scwpSc1uKI

    @Orion84x

    17 Sept 2026

    62 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  32. CISA added Cisco ISE CVE-2026-76460 (CVSS 10.0 API bypass) and Acronis CVE-2026-87886 to KEV. Source:… https://t.co/UtfjbYxz58 https://t.co/QC14eBVf0C

    @2Workly

    17 Sept 2026

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  33. 🐦 🚨 Cisco ISE auth bypass (CVE-2026-76460, CVSS 10.0) actively exploited in the wild — unauthenticated attackers get root. Cisco SEG SQLi (CVE-2026-76461, CVSS 9.8) also under active attack via crafted emails. Patch both now. #infosec #CVE #Cisco

    @ita_ipo

    17 Sept 2026

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. Cisco warns of active exploitation of CVE-2026-76460, a max-severity auth bypass in Cisco ISE and ISE-PIC. Emergency patches are available, with no workaround and guidance to check for compromise. #CiscoISE #CVE-2026-76460 #CISA https://t.co/wvksRavyyY

    @TweetThreatNews

    17 Sept 2026

    247 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  35. Critical Cisco ISE Vulnerability Exposes Networks to Unauthenticated Takeover A maximum-severity CVSS 10.0 API vulnerability in Cisco ISE (CVE-2026-76460) lets unauthenticated attackers bypass management… Full write-up → link in bio #cybersecurity #infosec #cve #kev #cisco

    @HotaSamit

    17 Sept 2026

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. Cisco released 15 advisories covering 42 vulnerabilities in Identity Services Engine. Six advisories rated Critical, including CVE-2026-76460 that permits management API authentication bypass and root command execution. ISE-PIC is also impacted. Exploitation confirmed in the

    @WorldCyberNewsX

    17 Sept 2026

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. 【サイバーセキュリティ動向分析】 1. Cisco ISEの認証バイパス脆弱性(CVE-2026-76460、CVSS 10.0)が実害用 背景 Cisco Identity Services https://t.co/coYhl3bfER

    @kenebeii

    17 Sept 2026

    4616 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  38. 🚨 CVE-2026-76460 (CVSS 10.0): Cisco Identity Services Engine Authentication Bypass Exploited in the Wild Critical Vulnerability Alert! Cisco Identity Services Engine (ISE) and ISE-PIC is affected by CVE-2026-76460. 🔍 Identify Targets via ZoomEye: Search Dork: app="Cisco

    @zoomeyebot

    17 Sept 2026

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  39. 🚨 CISCO SEPTEMBER 2026 HARDENING — 20+ CVEs, CVSS 10.0 ×4 Cisco ISE: 4 critical flaws + 7 more CVE-2026-76460 ACTIVELY EXPLOITED — CISA KEV NO WORKAROUNDS. PATCH NOW. → https://t.co/1DyvK8x2Pu #Cisco #CVE #CVSS10 #PatchNow #CyberSecurity #CyberSecurity #ThreatInte

    @ThreatAft

    17 Sept 2026

    86 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  40. CISA adds CVE-2026-76460 in Cisco ISE and CVE-2026-87886 in Acronis Backup to the KEV catalog. CVE-2026-76460 lets unauthenticated attackers bypass the ISE web interface via weak API authentication. CVE-2026-87886 enables privilege escalation through overly permissive defaults

    @WorldCyberNewsX

    17 Sept 2026

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  41. 🔒 #CyberSecurity CVE-2026-76460: Cisco ISE Privileged API Exploitation in the Wild — Detection a… "CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities (KEV) catalog on…" 🔗 https://t.co/iEaGLkTWf3 #CyberSecurity #ThreatIntel #cve202676460 #critical #ci

    @SecurityAr58409

    17 Sept 2026

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  42. CISA Adds Two Known Exploited Vulnerabilities to Catalog(CISA、悪用が確認された2件の脆弱性をKEVカタログに追加) #CISA (Sep 16) CVE-2026-76460 Cisco Identity Services Engineにおける特権APIの不適切な使用に関する脆弱性 CVE-2026-87886 Acr

    @foxbook

    17 Sept 2026

    247 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  43. 米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに1件と2件の脆弱性を追加。 - CVE-2026-58704 (Google Pixel) - CVE-2026-76460 (Cisco ISE) - CVE-2026-87886 (Acronis Backup) 対処期限は3日後の

    @__kokumoto

    16 Sept 2026

    913 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  44. 🚨 CVE-2026-76460 — CRITICAL — actively exploited per CISA KEV Cisco Identity Services Engine CVSS 10.0 #Cisco #CVE https://t.co/i0Ipnvm8Du

    @threatpodium

    16 Sept 2026

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  45. 🛡️ We added Cisco Identity Services Engine vulnerability CVE-2026-76460 & Acronis Backup vulnerability CVE-2026-87886 to our KEV Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/fmm

    @CISACyber

    16 Sept 2026

    8713 Impressions

    11 Retweets

    39 Likes

    9 Bookmarks

    0 Replies

    0 Quotes

Configurations