Critical severity10.0CISA KEVNVD Advisory· Published Sep 16, 2026· Updated Oct 7, 2026

CVE-2026-76460

Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisco Systems, Inc./ISEinferred
Cisco Systems, Inc./Identity Services Engine Software46 versions
cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:*+ 45 more
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch10:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch11:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch9:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch10:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch7:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch8:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch9:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch10:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch11:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch7:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch8:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch9:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.4.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.5.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine:3.5.0:patch3:*:*:*:*:*:*
Cisco Systems, Inc./Identity Services Engine Passive Identity Connector42 versions
cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:-:*:*:*:*:*:*+ 41 more
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch10:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch11:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch7:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch8:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:patch9:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch10:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch7:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch8:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.2.0:patch9:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch10:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch11:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch6:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch7:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch8:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.3.0:patch9:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:-:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch2:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch3:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch4:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch5:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.4.0:patch6:*:*:*:*:*:*
Cisco Systems, Inc./Identify Services Enginellm-fuzzy

Patches

Vulnerability mechanics

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5nvdMitigationVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation
Infosecurity Magazine · Oct 1, 2026
21st September – Threat Intelligence Report
Check Point Research · Sep 21, 2026
⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
The Hacker News · Sep 21, 2026
Weekly Cybersecurity Newsletter Bulletin – Cisco and Android 0-Day, BragJack Attack, Claude Opus 5 Used to Hack OpenAI, and 20+ Stories
Cyber Security News · Sep 21, 2026
Week in review: Cisco patches exploited email gateway 0-day, Revolut breach
Help Net Security · Sep 20, 2026
Breach Roundup: China Calls for Stronger AI Oversight
GovInfoSecurity · Sep 18, 2026
Cisco Zero-Day Highlights API Endpoint Authentication Issues
Dark Reading · Sep 18, 2026
Cisco alerts customers to second actively exploited zero-day in as many days
CyberScoop · Sep 17, 2026
Cisco drops another exploited zero-day, this time a perfect 10
The Register Security · Sep 17, 2026
Cisco Warns of Active Exploitation of Critical ISE Flaw
Infosecurity Magazine · Sep 17, 2026
Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks
Cyber Security News · Sep 17, 2026
Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Help Net Security · Sep 17, 2026
Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks
The Hacker News · Sep 17, 2026
Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
SecurityWeek · Sep 17, 2026
Cisco ISE and More: 25 Vulnerabilities Disclosed, Critical Auth Bypass Exploited
Vypr Intelligence · Sep 16, 2026
Cisco Vulnerability Added to CISA KEV Under Active Exploitation
Vypr Intelligence · Sep 16, 2026
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Alerts

cvss	0.650
epss	0.060
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000