CVE-2026-76460 (CVSS 10.0): Cisco ISE Authentication Bypass Gives Attackers Root Access — Your Zero-Trust Backbone Is Under Attack

Imagine discovering that every door in your building — every secured room, every server closet, every executive floor — can be opened with a single master key that anyone on the internet can use without knowing the lock combination. That is precisely what CVE-2026-76460 does to Cisco Identity Services Engine (ISE), the policy engine that controls network access for tens of thousands of enterprises worldwide. With a CVSS score of 10.0 — the maximum possible — and confirmed active exploitation in the wild, this vulnerability is not a theoretical risk. Attackers are already inside.

For Indian enterprises running Cisco ISE as the backbone of their zero-trust network access (ZTNA), 802.1X authentication, and remote VPN policy enforcement, this is a five-alarm fire. You need to act today.

What Is Cisco ISE — and Why This Vulnerability Is Catastrophic

Cisco Identity Services Engine is the central nervous system of enterprise network access control. It enforces 802.1X wired and wireless authentication, handles RADIUS and TACACS+ policy, manages guest portals, performs device posture assessment, and in modern deployments acts as the policy decision point for software-defined segmentation across data centres and campus networks.

In a zero-trust architecture, ISE is the authority that answers the question: “Does this device, this user, at this time, from this location, meet policy to access this resource?” Every network segment, VLAN, VPN tunnel, and SD-WAN application route can be gated behind an ISE decision. When that authority is compromised, the attacker does not merely own one server — they own the policy engine that governs everything.

CVE-2026-76460 exploits a critical flaw in ise-kong, the API gateway process that handles ISE’s REST management interface. The weakness is classified as CWE-648: Incorrect Use of Privileged APIs. An unauthenticated remote attacker sends a single crafted HTTP request to a specific API endpoint that lacks proper authentication controls. Upon receiving that request, ISE incorrectly processes it with elevated privilege, allowing the attacker to bypass the web-based management interface entirely and gain root-level access to the appliance.

Technical Breakdown: How CVE-2026-76460 Works

The vulnerability chain is elegantly simple — and therefore extremely dangerous.

Stage	What Happens	Impact
1. Reconnaissance	Attacker identifies ISE management interface (TCP 443 or 9060) reachable from the internet or internal network	Passive — no credentials required
2. Bypass	Single crafted HTTP request to the vulnerable ise-kong API endpoint, exploiting missing authentication on a privileged route	Authentication completely bypassed
3. Root Execution	Attacker executes arbitrary OS commands as root on the ISE appliance	Full system compromise
4. Lateral Movement	Attacker modifies network access policies, extracts RADIUS shared secrets, AD integration credentials, and certificate stores	Enterprise-wide access
5. Persistence	Attacker creates backdoor admin accounts, silently alters segmentation policies, or enables guest access for ongoing reconnaissance	Undetected long-term presence

What makes this particularly treacherous in a zero-trust deployment is the cascading policy failure. If an attacker modifies ISE policy to authorise their rogue device or user identity, every downstream enforcement point — FortiGate firewalls, Cisco Catalyst switches, wireless LAN controllers, SD-WAN edge devices — will faithfully permit the traffic. The zero-trust model is only as strong as the integrity of its policy engine. CVE-2026-76460 voids that integrity completely.

Active Exploitation Confirmed: What Attackers Are Doing

Cisco PSIRT confirmed on 16 September 2026 that CVE-2026-76460 is being actively exploited in the wild. Based on threat intelligence reports, observed post-exploitation activity includes:

• Credential extraction: Harvesting RADIUS shared secrets and Active Directory service account credentials stored in ISE, enabling authenticated access to any RADIUS-protected network resource.
• Policy tampering: Modifying authorization policies to grant attacker-controlled devices unrestricted network access across all VLANs, bypassing micro-segmentation.
• Log wiping: Deleting or altering ISE audit logs to erase evidence of the intrusion, complicating forensic investigation.
• Backdoor accounts: Creating hidden administrative accounts in ISE that survive patch updates if not explicitly removed during remediation.
• Pivot to AD: Using ISE’s Active Directory integration credentials to pivot directly into the corporate directory, enabling password resets, GPO modification, and broad lateral movement.

The threat profile is consistent with both opportunistic ransomware operators looking to maximise damage before detonating and nation-state actors seeking persistent, policy-level access to high-value networks. ISE environments in financial services, critical infrastructure, defence supply chains, and government networks are high-priority targets.

Affected Versions and the Patch Matrix

CVE-2026-76460 affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.0 through 3.5. Cisco has released the following patched builds:

ISE Version	Fixed in Patch	Status
3.0	End of Maintenance — upgrade required	Unsupported
3.1	3.1 Patch 12	Patch available
3.2	3.2 Patch 11	Patch available
3.3	3.3 Patch 12	Patch available
3.4	3.4 Patch 7	Patch available
3.5	3.5 Patch 4	Patch available

Important: Cisco states there are no workarounds for this vulnerability. Disabling the REST API is not a supported mitigation and may break critical ISE functionality. The official Cisco Security Advisory should be your first stop for the latest patch guidance and hotfix availability.

What You Should Do Right Now — Sanjay’s Expert Guidance

Having architected and hardened Cisco ISE deployments across Indian enterprise, financial, and government networks for over three decades, here is the immediate action plan I recommend to every CISO and NOC/SOC team managing an ISE environment:

Immediate (within 24 hours)

1. Determine your ISE version right now. Log in to the ISE dashboard and navigate to Administration → System → Deployment. Every node in the deployment must be identified and patched individually.
2. Restrict management interface access urgently. If you cannot immediately patch, use your perimeter firewall or ISE network device groups to whitelist only known admin workstations and jump servers for access to the ISE management interface (TCP 443, 9060, and 9443). This is not a workaround — the vulnerability may still be exploitable from permitted IPs — but it dramatically reduces your attack surface while you prepare for patching.
3. Review recent ISE audit logs for anomalies. Look for: unexpected admin logins, policy changes outside change-management windows, new administrator accounts, and API calls from unfamiliar source IPs. If logs have been wiped or show gaps, treat your ISE as compromised and proceed to incident response immediately.
4. Alert your SOC. Create a detection rule for unexpected administrative API calls to ISE management endpoints. Threat actors exploiting CVE-2026-76460 will generate characteristic HTTP traffic patterns that an alert SOC can catch.

Within 72 Hours

1. Apply the appropriate patch from the table above. Cisco patches for ISE are delivered as patch bundles applied through Administration → System → Maintenance → Patch Management. Plan a maintenance window — the patch requires a service restart and may take 30–60 minutes per node in a distributed deployment.
2. Rotate all RADIUS shared secrets and AD service account passwords after patching. Even if you believe you were not exploited, a policy of “patch and rotate” is sound hygiene given active exploitation in the wild.
3. Verify no backdoor accounts were created. After patching, export the full administrator account list from ISE and compare against your known administrator roster. Remove any unrecognised accounts immediately.
4. Check ISE certificate stores for any certificates you do not recognise — attackers may have imported their own CA or endpoint certificates to enable future trusted access.

For organisations running FortiGate SD-WAN and campus zero-trust architectures alongside Cisco ISE, the remediation window is also the right moment to re-evaluate whether a single-vendor ZTNA policy plane reduces this kind of cross-platform blast radius. ISE does an exceptional job in Cisco-heavy environments, but its compromise shows why architectural diversity and defence-in-depth matter — your enforcement points (FortiGate, FortiAuthenticator, FortiAP) should be capable of enforcing baseline policy even if the upstream identity broker is unavailable or compromised.

If you are unsure whether your ISE deployment is exposed, or you need a forensic review of audit logs and policy configurations, a zero-trust network audit is the fastest way to establish your current risk posture with certainty.

Implications for Indian Enterprises and Regulatory Obligations

Indian organisations have specific notification obligations that interact directly with this vulnerability:

• CERT-In (2022 Directions): Any confirmed exploitation of CVE-2026-76460 on your infrastructure constitutes a cybersecurity incident that must be reported to CERT-In within six hours of detection. If you discover backdoor accounts or policy modifications consistent with exploitation, start your reporting clock immediately.
• SEBI CSCRF: Regulated entities (brokers, AMCs, depositories, exchanges) must patch critical vulnerabilities within mandated timelines and report material cyber incidents. A compromised ISE appliance in a financial network is almost certainly a material incident requiring disclosure.
• DPDP Act 2023: If the attacker used compromised ISE credentials to access systems containing personal data, the DPDP Act’s breach notification provisions are triggered.

Do not let regulatory complexity delay your patching decision. Patch first, document everything, then notify. The regulator will ask why you patched — a clear answer is “confirmed active exploitation with CVSS 10.0” — they will not ask why you patched so quickly.

Frequently Asked Questions

Is Cisco ISE exposed to the internet in most Indian enterprises?

Ideally, no — the ISE management interface should be reachable only from internal management networks or jump servers. However, in practice many organisations expose the GUI and API ports for remote management convenience, particularly in organisations that expanded rapidly during the COVID-era shift to hybrid work. A quick firewall rule audit and a scan for ISE management port exposure from your DMZ/internet perspective is worth doing today.

Can my SIEM or IDS detect active exploitation attempts?

Yes, with the right signatures. The exploit sends a crafted HTTP request to a specific API path on the ISE management interface. If your network monitoring captures full HTTP metadata (method, URI, status code) for management traffic — which it should in a mature NOC/SOC environment — you can create a detection rule for unexpected successful responses to that endpoint from unauthenticated sources. Cisco Talos and commercial threat intelligence feeds now carry indicators of compromise for active exploitation campaigns targeting CVE-2026-76460.

Does this affect cloud-hosted Cisco ISE deployments?

The vulnerability is in the ISE software itself, so any deployment — on-premises physical appliances, VMware virtual machines, or AWS/Azure-hosted ISE instances — running an affected version (3.0–3.5 before the patch) is vulnerable. Cloud-hosted deployments may have additional network controls at the hypervisor or security-group level that reduce exposure, but they are not immune. Patch regardless of deployment model.

We are mid-migration from ISE to a different NAC vendor — are we still at risk?

Yes, if you have any ISE nodes still running and managing policy for any part of your network, you are at risk. Parallel-running legacy and new systems during migrations are frequently the most dangerous configuration because security attention is divided. Prioritise patching or decommissioning any ISE node still handling live policy, even if it is scheduled for retirement.

Authoritative Sources

• Cisco Security Advisory: CVE-2026-76460
• CISA Known Exploited Vulnerabilities Catalog
• The Hacker News: Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0)
• BleepingComputer: Cisco confirms ISE flaw exploited in attacks
• Help Net Security: Unauthenticated attackers bypassing Cisco ISE