Affected Systems
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) versions 3.1, 3.2, 3.3, 3.4, and 3.5. CVE-2026-76460 affects all configurations due to insufficient authentication control on an API endpoint.
Exploitation Status
Actively exploited in the wild. Cisco PSIRT confirmed active exploitation. CISA added CVE-2026-76460 to KEV catalog with 3-day patching deadline for federal agencies.
Business Impact
Remote attackers can bypass authentication and gain unauthorized access to ISE management interface without credentials. ISE is a centralized policy platform controlling network access and Zero Trust enforcement—compromise enables attackers to manipulate access policies, pivot to network resources, and establish persistence with root privileges. Attackers may delete logs after exploitation. No workarounds available.
Urgency
🔴 Immediate
Recommended Actions
- Apply Cisco patches immediately: ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4
- Search access.log files on all ISE nodes for suspicious or unknown usernames as indicators of compromise
- Review firewall and network logs for unusual downloads/uploads to external or malicious IP addresses associated with ISE nodes
- If malicious activity is detected, re-image affected ISE nodes and restore from known-good backups
- Federal agencies: comply with CISA KEV 3-day patching mandate by September 20, 2026