CISA_KEV · SEPTEMBER 2026 · CONFIRMED

CVE-2026-76460: Cisco ISE Unauthorized Access Vulnerability

Severity: HIGH
Affected component: cisco identity services engine (other)
Patched version: Not yet available

CVE-2026-76460

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) have a vulnerability that allows unauthenticated, remote attackers to gain unauthorized access by bypassing the web-based management interface.

What happened

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability. This vulnerability, tracked as CVE-2026-76460, could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. The vulnerability was first flagged on 2026-09-16 and confirmed on the same day. It is currently being exploited in the wild.

The affected components are Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). However, no authoritative version range has been published yet. Therefore, it is recommended to monitor for any signs of unauthorized access and apply patches as soon as they are available from Cisco.

What to do about it

Monitor for any signs of unauthorized access to your Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
Apply patches as soon as they are available from Cisco.
No official fix has been published yet. Monitor the sources below for updates:

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If cisco identity services engine is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Cisco Identity Services Engine (ISE) or Cisco ISE Passive Identity Connector (ISE-PIC). However, no authoritative version range has been published yet.

What should I do right now?

Monitor for any signs of unauthorized access and apply patches as soon as they are available from Cisco.

Has this been exploited in the wild?

Yes, this vulnerability is currently being exploited in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats