Cisco ISE API authentication bypass exploited as a zero-day; Cisco warns of possible root access

CVE-2026-76460 is an authentication bypass in an API of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC), rated CVSS 10.0 ¹. A remote attacker with no credentials can send a crafted request to an affected API endpoint and gain access to the device without passing through the web-based management interface ¹. Cisco says every configuration of both products is affected ¹.

Cisco states that its PSIRT "is aware of active exploitation of this vulnerability" and published fixes on 2026-09-16 ¹. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of 2026-09-19 ^2,4. The flaw surfaced while Cisco TAC was working a customer support case, ¹, and CyberScoop reports it was exploited before Cisco disclosed and patched it ⁶.

Cisco has not said when exploitation began, who is behind it or how many organizations were compromised, and no threat actor has been named ^3,6. Dark Reading reports the scale of the activity remains unclear ⁷. A VulnCheck researcher quoted by CyberScoop says root on an ISE appliance would let an attacker change access policy, pull stored credentials and move into the network segments ISE controls ⁶. Researchers quoted by Dark Reading stress that ISE decides which users and devices can connect, so its compromise carries risk across the wider environment ⁷.

Cisco attributes the bug to insufficient authentication control on an API endpoint and classifies it as CWE-648, incorrect use of privileged APIs ^1,2. The advisory does not name the endpoint ¹. Exploitation needs only network reach to the vulnerable API and one crafted request, with no user interaction ¹.

The direct result is unauthorized access that sidesteps the management UI ¹. Cisco adds that successful exploitation may give threat actors command execution as root, and that at that level they can remove or hide evidence and indicators of compromise ¹. Treat a clean on-box log review as inconclusive for that reason.

Cisco's advisory for this flaw lists a single CVE ¹. Cisco shipped other critical ISE fixes on 2026-09-16, and its companion hardening advisory says one improper-access-control (CWE-284) flaw in that bundle is known to be actively exploited, pointing readers to this advisory ⁸. Cisco has not said whether that refers to CVE-2026-20192 or to this bug; the Cyber Centre marks only CVE-2026-76460 as exploited ². Patch the companion flaws in the same window.

1. 1

   Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4; Cisco states no workaround addresses the flaw ¹.

2. 2

   Move 3.0 deployments, which are past End of Software Maintenance, to a supported release that contains the fix ¹.

3. 3

   Until patched, apply infrastructure ACLs that permit only required management and control-plane traffic to ISE; Cisco calls this a temporary measure that prevents remote exploitation ¹.

4. 4

   Keep ISE management interfaces on trusted administration networks behind segmentation, and monitor firewall, network and authentication logs for anomalies ².

5. 5

   If any sign of compromise appears, re-image the affected nodes and restore from a configuration backup if needed, as Cisco recommends ¹.

6. 6

   After any sign of compromise, rotate secrets held by ISE; a researcher quoted by CyberScoop notes root access on the appliance can be used to extract stored credentials ⁶.

• On each node, review the API gateway log with show logging application ise-kong/access.log and look for usernames that do not belong to your administrators or integrations; Cisco says any such entry may indicate malicious activity ¹.
• Cisco's sample filter uses the placeholder username dummyuser and is explicitly non-exhaustive, so do not treat a single string match as the full hunt ¹.
• For rotated logs, collect a support bundle with debug logs included and shared-key encryption, decrypt it, and review the archives under ./ise/logs/apigateway/ ¹.
• Repeat the review on every node of a distributed deployment, not only the primary administration node ¹.
• Correlate with network and firewall logs outside the appliance for unexpected uploads from ISE to external IPs or downloads from known-malicious IPs, since a root-level intruder can scrub on-box logs ^1,5.
• Inventory ISE and ISE-PIC versions and flag any node below the fixed patch for its train, including 3.0 nodes that cannot be fixed ¹.

1. Sep 16, 2026

   Cisco publishes advisory cisco-sa-ISE-ABP-VNSW7Tn5 with fixes and confirms active exploitation ¹

2. Sep 16, 2026

   CISA adds CVE-2026-76460 to the KEV catalog ²

3. Sep 17, 2026

   Canadian Centre for Cyber Security issues alert AL26-021 ²

4. Sep 19, 2026

   KEV remediation deadline for US federal civilian agencies ⁴

1. 1
   Cisco Identity Services Engine Authentication Bypass Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5)

   Cisco PSIRT · Vendor · Sep 16, 2026
2. 2
   AL26-021 - Vulnerabilities Impacting Cisco ISE and ISE-PIC

   Canadian Centre for Cyber Security · Government · Sep 17, 2026
3. 3
   Cisco warns of max severity ISE zero-day exploited in attacks

   BleepingComputer · News · Sep 17, 2026
4. 4
   Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

   The Hacker News · News · Sep 17, 2026
5. 5
   Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day

   SecurityWeek · News · Sep 17, 2026
6. 6
   Cisco alerts customers to second actively exploited zero-day in as many days

   CyberScoop · News · Sep 17, 2026
7. 7
   Cisco Zero-Day Highlights API Endpoint Authentication Issues

   Dark Reading · News · Sep 18, 2026
8. 8
   Cisco Identity Services Engine Hardening Release: September 2026 (cisco-sa-hardening-ise-XU5EwX5T)

   Cisco PSIRT · Vendor · Sep 16, 2026