Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-76460 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-16 |
| Vendor | Cisco |
| Product | Identity Services Engine |
| CVSS Score | 10.0 (critical) |
| EPSS Score | 0.8% (percentile: 54%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-19 |
Vulnerability Description
Source: CISA KEV
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability.
It allows an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. Controls enforced by that interface are therefore not an effective barrier here — access happens alongside them.
The severity follows from the product’s function in the security architecture. ISE is a network access control (NAC) system — it decides which devices and which users enter the network at all, and with what privileges. Taking control of such a system is not an incident confined to one server; it undermines the mechanism that segmentation and authentication across the network rely on.
CVSS 10.0 is the top of the scale. The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-19 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC).
When assessing urgency, consider not only whether the ISE management interface is internet-facing, but also the system’s reach inside the network. ISE has access to authentication infrastructure and access policies by design — the consequences of its compromise travel further than the host itself. If the appliance was reachable from untrusted networks, run a post-intrusion review after patching.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
