Security Intelligence
Loading table of contents...
At a glance:
-
An actively exploited authentication bypass vulnerability in Cisco ISE and Cisco ISE-PIC allows remote, unauthenticated access to a management API and may lead to root-level command execution.
-
ISE deployments that act as a central authority for network access decisions represent higher-value targets because they contain identity, policy, and access-control information used throughout the environment.
-
Upgrading to a fixed release, restricting management-interface access, and performing compromise assessment across appliance and network logs helps reduce exposure and identify potential exploitation.
Threat summary
On September 16, Cisco released security updates for an actively exploited authentication bypass vulnerability in an API endpoint used by Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
Cisco assigned the vulnerability a CVSS score of 10.0, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog the same day.
ISE is Cisco's network access control platform. It authenticates users and devices, evaluates security posture, enforces access policies, and determines which network resources users and devices can access. ISE-PIC is a related platform that uses the same underlying technology to collect identity information, such as user-to-IP address mappings, and share it with security tools including firewalls and security analytics platforms.
Both products use a common management framework that provides administrative functions through HTTPS-based application programming interfaces (APIs).
The flaw, tracked as CVE-2026-76460, is an authentication bypass vulnerability affecting one of these management API endpoints. Insufficient authentication controls allow a remote, unauthenticated threat actor to send a crafted request to the API and gain unauthorized access by bypassing the web-based management interface.
The vulnerable component is part of the management plane used to administer the appliance rather than the network authentication functions that validate users and devices. Successful exploitation provides unauthorized access to the system and may allow command execution with root privileges. The affected API endpoint, underlying code flaw, and actions required to progress from unauthorized access to root-level execution have not been publicly disclosed.
Affected releases include Cisco ISE and ISE-PIC versions 3.0 through 3.5 releases, regardless of deployment configuration.
Cisco released fixes in ISE:
-
3.1 Patch 12
-
3.2 Patch 11
-
3.3 Patch 12
-
3.4 Patch 7
-
3.5 Patch 4
Cisco reported that no software workaround addresses the vulnerability. Infrastructure access control lists (iACLs) can be used to restrict traffic reaching affected devices.
Analysis
Organizations that expose ISE or ISE-PIC management services beyond dedicated administrative networks face the greatest risk. Exploitation does not require credentials or user interaction, allowing any threat actor capable of reaching the vulnerable API to attempt exploitation.
While internet-accessible deployments are the most obvious target, management interfaces reachable from internal networks remain relevant because compromised workstations, virtual private network (VPN) access, or other footholds may provide access to the same administrative services.
Deployments that act as a central policy and access-control authority also represent higher-value targets because they typically provide access to a broader range of administrative functions and operational data.
Identity and access-control platforms have historically been attractive targets because they sit at the intersection of users, devices, and network access decisions. Cisco ISE commonly integrates with authentication services, network infrastructure, wireless environments, VPN deployments, and security tools. As a result, access to the platform can provide visibility into how users and devices are identified, authenticated, and granted access throughout the environment.
Administrative access to an identity and access-control platform may expose configuration data, authentication policies, endpoint inventories, integration settings, and other operational information managed by the appliance. The resulting impact depends on the role of the affected deployment, the systems integrated with it, and the administrative functions available from the compromised node.
In environments where ISE serves as a central access-control platform, a compromise may provide insight into how network access is managed across users, devices, and connected systems.
Mitigations
Review how ISE and ISE-PIC management interfaces are exposed within the environment. Restricting administrative access to dedicated management networks and trusted administrative workstations reduces the number of systems capable of communicating with the affected interface. Infrastructure iACLs, firewall rules, and network segmentation can reduce exposure while updates are being deployed, although these controls do not remove the vulnerability itself.
Reviewing API gateway access logs on every node for suspicious usernames and noted IoCs helps determine whether the flaw may have been exploited before remediation. In distributed deployments, each node maintains its own logs, so reviewing a single node may not identify activity elsewhere in the deployment. Any unexpected usernames, unauthorized administrative activity, or unexplained management access warrants further investigation.
Correlate appliance logs with firewall, proxy, network flow, and other external logging sources. Successful exploitation may allow root-level access to the appliance, meaning evidence stored locally could possibly be altered or removed. External telemetry provides an independent source of evidence and can help identify connections, uploads, downloads, or administrative activity that may no longer be visible on the affected device.
Investigate connected systems, service accounts, identity integrations, and administrative accounts when indicators of compromise are identified. Because Cisco ISE commonly integrates with various tools and services, reviewing configuration changes, newly created accounts, modified policies, and integration settings can help determine whether unauthorized access extended beyond the initial appliance.
If compromise is confirmed, re-imaging affected nodes and restoring from a trusted backup helps return the platform to a known-good state and removes any unauthorized changes that may not be visible through routine administration.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
