Cisco ISE CVE-2026-76460: CVSS 10.0 Authentication Bypass Under Active Exploitation
Cisco ISE CVE-2026-76460: CVSS 10.0 Authentication Bypass Under Active Exploitation
Cisco has warned of a maximum-severity vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows an unauthenticated remote attacker to bypass authentication and gain root command execution on the underlying appliance. Tracked as CVE-2026-76460 and rated CVSS 10.0, the flaw is already being exploited in the wild. On September 16, 2026, CISA added the bug to the Known Exploited Vulnerabilities catalog, giving U.S. federal civilian agencies until September 19 to apply fixes.
How the Flaw Works
The vulnerability stems from insufficient authentication controls on an internal API endpoint. Cisco says an attacker can send a single crafted HTTP request to the affected endpoint and bypass the web-based management interface entirely — no credentials, no session, no user interaction required. On a successful exploit, the attacker obtains root privileges on the ISE appliance. Cisco notes that root access gives the attacker the ability to remove or hide evidence of exploitation, which is why the advisory places heavy emphasis on proactive detection rather than post-hoc forensics.
The flaw affects every Cisco ISE and ISE-PIC deployment, regardless of configuration, in the following supported branches: 3.1 (fixed in Patch 12), 3.2 (Patch 11), 3.3 (Patch 12), 3.4 (Patch 7), and 3.51 (Patch 4). Cisco has not released any workaround; the only mitigation it recommends is the use of infrastructure access control lists (iACLs) to limit the management and control-plane traffic that can reach an ISE appliance at all.
Detection and Broader Context
Cisco's published indicator is a single command. Operators should look for the literal string dummyuser in the ISE access log — a value Cisco's exploit attempts themselves produce:
admin#show logging application ise-kong/access.log | include dummyuser
Any match likely indicates malicious activity, and because the attacker runs as root, Cisco's remediation guidance for confirmed exploitation is to re-image affected nodes and restore from a known-good configuration backup. The CVE-2026-76460 disclosure is part of a much larger September 16 bundle: Cisco released 77 new CVEs in one day, 41 of which affect ISE and 28 of which affect the Secure Firewall portfolio — including additional CVSS 10.0 ISE REST-API bypasses (CVE-2026-76423 through CVE-2026-76428) and FMC command-injection flaws that allow an authenticated remote attacker to run commands as root.
What Should You Do?
- Patch immediately to the fixed ISE versions. 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.51 Patch 4 — and restart services as Cisco's release notes direct. Do not assume an ISE appliance is safe just because it is on a recent release train; the patch level matters.
- If you cannot patch within the CISA window, restrict management reachability with iACLs. Allow only the management subnets that genuinely need to reach ISE, and block everything else at the network edge. Treat ISE's management interface as a Tier 0 control-plane asset.
- Hunt for the dummyuser IoC today. Run the access-log command across every ISE node — including every member of a distributed deployment — and assume compromise on any hit. Re-image the affected node and restore from configuration backup; do not trust the filesystem afterward.
- Audit the rest of the September 16 Cisco bundle. The same advisory day fixed additional CVSS 10.0 REST-API bypasses (CVE-2026-76423–76428), Nexus Dashboard command-injection (CVE-2026-20322/20325/20326), and an FMC sftunnel RCE (CVE-2026-20324). Build the patch set, not just the headline CVE.
The WAF Angle
CVE-2026-76460 is a reminder that the most damaging web-facing controls are often the ones a WAF does not see. ISE's management interface is supposed to live on a restricted admin network, but in practice it is reachable from anywhere an attacker can route a single crafted HTTP request to. A network-layer WAF in front of ISE would not stop this bypass — the request is well-formed at the protocol level. What stops it is treating management endpoints as a separate trust zone (iACLs, jump hosts, MFA on every admin path) and detecting exploitation at the application layer. The dummyuser string is a one-line indicator that should already be inside every detection-as-code pipeline, because Cisco's own exploit attempts leave a fingerprint. Finally, the volume of Cisco's September bundle is itself a pattern: when a vendor ships 77 CVEs in one day, defenders should run their patch-deployment playbooks as a fire drill, not a checklist.
