Cisco’s Identity Services Engine controls who and what gets onto the corporate network. On September 16, 2026, CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog and set a federal patch deadline of September 19. Cisco’s advisory gives the flaw a CVSS 3.1 score of 10.0: an unauthenticated remote attacker can send a crafted request to an affected API endpoint and bypass authentication entirely. It’s under active exploitation right now.
How the bypass works
From ISE release 3.1 onward, the Monitoring APIs, the External RESTful Services APIs, and the Open APIs all route through the Kong API Gateway. The bug is insufficient authentication checking on a specific endpoint behind that gateway, and because Kong sits in front of every ISE application server, a bypass there compromises the whole deployment. There’s no password to crack, no session token to steal, no phishing required. A single crafted HTTP request convinces the gateway the caller is already authenticated.
From that point, the attacker has administrative access to the device. ISE runs with deep system-level permissions to manage network policy, RADIUS/TACACS+ traffic, and 802.1X profiling, so admin access on ISE escalates to root on the underlying Linux OS without much resistance. Both Cisco ISE and the ISE Passive Identity Connector (ISE-PIC) are affected regardless of configuration.
Indicators of compromise and hunting
Cisco PSIRT found this during a TAC support case, which tells you it was already being exploited before anyone was looking for it. Detection is hard: attackers with root can wipe or alter local logs on the ISE node, so you can’t fully trust what’s on the box after a compromise. Cisco’s guidance is to SSH into every ISE node and pull the Kong API gateway logs, checking for anomalous requests. They’ve published a specific query to hunt for suspicious usernames hitting the API, and the presence of the string dummyuser (or any other unexpected, non-standard username) in the access.log output is the primary tell.
Because attackers may have scrubbed the ise-kong logs, correlate with external perimeter firewall logs too. Look for unexpected outbound connections from ISE management IPs, unusual data uploads, or traffic to known-bad IPs shortly after anomalous API calls.
Remediation
There’s no workaround that fully fixes this. Cisco says so directly. The only real fix is upgrading ISE and ISE-PIC to a patched release: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. ISE 3.0 is past End of Software Maintenance, so if you’re still on it, migrate to a supported version now, not after patching this.
If you can’t get a maintenance window immediately, lock down access with infrastructure ACLs on upstream routers and firewalls, restricting management and control-plane traffic to authorized admin jump hosts and API management subnets only.
If threat hunting turns up evidence of exploitation, don’t just patch the node. Root access lets attackers plant backdoors that survive a software update. Isolate the box, re-image it from scratch, and restore configuration from a known-good backup.
The rest of Cisco’s September 2026 patch batch
CVE-2026-76460 is the headline item in a September release that covers 77 new CVEs across Cisco’s portfolio, 41 of them in ISE and 28 in Secure Firewall. ISE also got a second CVSS 10.0 REST API authentication bypass this month, CVE-2026-76423, plus CVE-2026-20176, CVE-2026-20211, and CVE-2026-20307, which let authenticated attackers run arbitrary commands on the underlying OS.
Secure Firewall picked up its own critical patches. CVE-2026-20324 hits the sftunnel inter-device communication protocol in Secure Firewall Management Center, scoring 9.9, and lets an authenticated attacker write arbitrary files and get root, which is bad news for high-availability firewall clusters. A few days before that, Cisco flagged active exploitation of CVE-2026-76461 (CVSS 9.8), a SQL injection bug in AsyncOS for Cisco Secure Email Gateway that also leads to root.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →Why this matters beyond ISE
Identity infrastructure has become the thing attackers go after directly, not just the edge firewall standing in front of it. Getting into ISE lets an attacker authorize rogue devices, sidestep 802.1X controls, intercept RADIUS credentials, and move laterally with the network’s own trust already extended to them.
Centralized policy engines need defense-in-depth on their own, separate from everything else in the stack. API gateways like Kong make automation easier and also give attackers one more layer to target, so it’s worth treating internal management planes with the same zero-trust scrutiny as anything external, auditing API endpoints for privilege escalation on a regular basis, and keeping offline backups of network infrastructure configs in case a node needs to be rebuilt from nothing.
FAQs
Is CVE-2026-76460 a critical Cisco ISE vulnerability?
Yes. CVE-2026-76460 is described as a critical Cisco ISE authentication bypass vulnerability with a CVSS score of 10.0.
What is CVE-2026-76460?
CVE-2026-76460 is an authentication bypass vulnerability affecting Cisco Identity Services Engine that can allow an unauthenticated attacker to gain administrative access.
Can CVE-2026-76460 lead to root access?
The impact described for the vulnerability can extend from unauthorized administrative access to control of the underlying ISE system.
Which Cisco ISE versions need to be patched?
The article identifies patched releases including ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
How can organizations detect exploitation of CVE-2026-76460?
Administrators should investigate Cisco ISE Kong API gateway logs for anomalous authentication requests and correlate findings with external firewall and network telemetry.
