Cisco ISE and More: 25 Vulnerabilities Disclosed, Critical Auth Bypass Exploited
Cisco disclosed 25 vulnerabilities on Sept 16, 2026, including a critical, actively exploited auth bypass in ISE (CVE-2026-76460) and multiple SQL injection and file access flaws.
Key findings
- 25 CVEs disclosed for Cisco ISE, ISE-PIC, Nexus Dashboard, and ThousandEyes Virtual Appliance on September 16, 2026.
- Critical CVE-2026-76460 (CVSS 10.0) in Cisco ISE is actively exploited, allowing unauthenticated remote authentication bypass.
- Multiple SQL/HQL injection vulnerabilities (CVE-2026-76451, CVE-2026-76450, etc.) affect ISE and ISE-PIC due to insufficient input validation.
- Several vulnerabilities allow arbitrary file read/write/deletion (CVE-2026-76446, CVE-2026-76434, CVE-2026-76431) in ISE and ISE-PIC.
- High-severity flaws include an ASDM SSO bypass (CVE-2026-76413) and a remote diagnostics debugger enablement (CVE-2026-76412) in Secure FMC Software.
- Cisco has released patches; immediate updates are recommended, especially for CVE-2026-76460.
On September 16, 2026, Cisco Systems disclosed a significant batch of 25 vulnerabilities affecting multiple products, with a particular focus on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The most critical of these, CVE-2026-76460, is a maximum-severity (CVSS 10.0) authentication bypass flaw in an ISE API that has been observed under active exploitation. This disclosure highlights potential weaknesses in API endpoint security and authentication controls across Cisco's product lines.
Several vulnerabilities fall into the category of SQL or HQL injection, including CVE-2026-76451, CVE-2026-76450, CVE-2026-76449, and CVE-2026-76448, all with medium severity. These stem from insufficient validation of user-supplied input to affected APIs. Similarly, CVE-2026-76428 and CVE-2026-76427 also involve SQL injection in REST APIs, targeting the session and monitoring databases respectively. A high-severity SQL injection vulnerability, CVE-2026-76425, was also noted in ISE APIs.
File access and manipulation vulnerabilities are also prevalent. CVE-2026-76446, a medium-severity flaw, allows an authenticated attacker to read specific files due to improper XML external entity reference handling. CVE-2026-76434, another medium-severity issue, permits an authenticated attacker with administrative credentials to read arbitrary files via the certificate import functionality. Additionally, CVE-2026-76433 and CVE-2026-76432, both medium-severity, involve an unauthenticated attacker accessing protected files and an authenticated attacker writing arbitrary files, respectively, due to insufficient validation of directory traversal sequences. CVE-2026-76412, a high-severity vulnerability, allows an authenticated attacker to enable a remote diagnostics debugger service in Cisco Secure FMC Software.
Other notable vulnerabilities include CVE-2026-76444, a medium-severity flaw allowing an unauthenticated attacker to retrieve sensitive configuration information from an internal service. CVE-2026-76439, also medium-severity, permits an unauthenticated attacker to submit forged posture status events through the guest portal. CVE-2026-76438, a medium-severity vulnerability in Cisco BroadWorks CommPilot Application Software, allows a low-privilege authenticated attacker to alter configurations due to missing authorization checks. CVE-2026-20350, a medium-severity vulnerability in Cisco ThousandEyes Virtual Appliance, allows an authenticated attacker to inject arbitrary OS commands.
High-severity vulnerabilities were also found in Cisco Nexus Dashboard, with CVE-2026-20360 and CVE-2026-20352 addressing internally discovered issues and a denial-of-service condition, respectively. CVE-2026-20352 specifically allows an unauthenticated, remote attacker to cause a denial of service by improperly handling certain RADIUS requests. CVE-2026-76413, a high-severity flaw in Cisco Adaptive Security Device Manager (ASDM) single sign-on handler, could allow an unauthenticated attacker to log in as the ASDM administrator.
Cisco has released software updates to address these vulnerabilities. Users are strongly advised to consult Cisco's security advisories for specific version information and remediation steps. The active exploitation of CVE-2026-76460 underscores the urgency for organizations to apply patches promptly to mitigate the risk of unauthorized access and potential system compromise.
The sheer number and variety of vulnerabilities disclosed in this batch highlight the importance of regular security audits and timely patching for Cisco products, particularly for network access control and security management solutions like ISE. The active exploitation of the critical authentication bypass vulnerability serves as a stark reminder of the ongoing threat landscape and the need for robust security practices. Users should remain vigilant for further advisories and ensure their systems are updated to the latest secure versions.