Cisco ISE authentication bypass actively exploited
Cisco has identified a maximum-severity authentication-bypass flaw in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector. According to the company, exploitation was already ongoing. Additional information about the attacker, victims, geography, when observed attacks began, or post-compromise activity was not publicly shared.
The flaw affects ISE releases 3.0 through 3.5 regardless of configuration and lets an unauthenticated remote attacker bypass the web management interface through a crafted API request. Successful exploitation may provide root command execution, allowing an attacker to alter or erase local evidence. CISA added the flaw (CVE-2026-76460) to its KEV on September 16.
Cisco Identity Services Engine is a central policy point for access admission of users and devices, both wired and mobile, on local networks or remote. If compromised, both the enforcement plane and the trustworthiness of access records are threatened.
Operational consequences could include unauthorized network admission, policy manipulation, credential or configuration exposure, and a wider compromise-assessment burden because local logs may be incomplete.
Organizations using ISE in critical or important services should treat the issue as an identity and network-control incident, not a routine patch item. Under NIS2-aligned national rules, a confirmed compromise may require rapid assessment against significant-incident thresholds and national reporting timelines. DORA-regulated financial entities should also evaluate whether affected access-control services support critical or important functions and activate their incident-classification process where warranted.
Recommended actions
Every ISE and ISE-PIC node should be identified in an enterprise-wide inventory, including management exposure, release, patch level, deployment role and owner. Network engineering should restrict management-plane traffic with infrastructure access controls while change teams upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. (Release 3.0 has no fixed build and needs an approved migration decision.)
Security operations should preserve and review access.log on every node, then correlate firewall, proxy and network telemetry outside ISE for unexpected transfers or management activity. If suspicious usernames or root-level activity are found, re-imaging and trusted configuration restoration should be conducted rather than relying on patching alone. Legal, privacy and operational-risk teams should pre-agree the evidence threshold for NIS2, DORA, customer and board escalation because attacker access may have degraded the primary audit trail.
Cisco has clarified that disabling APIs does not eliminate the risk; administrative access restrictions are compensating controls, not a substitute for upgrading. Organizations should also verify that upgrades address Cisco’s wider September ISE security release, while keeping CVE-2026-76460 separate as the only flaw in that release set confirmed here as actively exploited.
Conclusion
The key governance lesson is that compromise of an identity and network-policy platform can invalidate both enforcement and the evidence used to assess the incident. Treat remediation and compromise assessment as one decision: patch every node, but re-image where evidence indicates abuse or where root access prevents confidence in local logs. For NIS2- and DORA-exposed organizations, incident classification should start in parallel with technical validation, not after forensics are complete.
Sources
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
Further reading: