Cisco ISE Zero-Day: Root Access via Auth Bypass

Key Takeaways

Cisco has disclosed and patched a maximum-severity authentication bypass, tracked as CVE-2026-76460, affecting its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products, and the company has confirmed that the flaw is being actively exploited in production networks [1][2]. The vulnerability carries the highest possible CVSS score of 10.0 and stems from insufficient authentication control on an ISE API endpoint, allowing a remote, unauthenticated attacker to bypass the web-based management interface entirely and obtain command execution with root privileges on the underlying appliance [1][3]. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, one day before Cisco’s public advisory, and directed federal civilian agencies to prioritize remediation under Binding Operational Directive 26-04 [4][5]. Because ISE typically serves as the central policy decision point for network access control and Zero Trust enforcement, a successful compromise can extend well beyond the appliance itself, potentially affecting identity and access decisions across the enforcing network [2]. Organizations running any supported release of ISE or ISE-PIC should treat this as an emergency patching event rather than a routine maintenance cycle, since Cisco has confirmed no workaround exists [1][3].

Background

Cisco Identity Services Engine is a centralized policy platform that enterprises use to authenticate and authorize the devices and users connecting to their wired, wireless, and VPN infrastructure. Rather than sitting at the network edge, ISE typically occupies a privileged position at the center of an organization’s access control architecture, making continuous decisions about which endpoints are trustworthy, what posture they must demonstrate, and what network segments they may reach. Many organizations have adopted ISE specifically as the enforcement engine for Zero Trust initiatives, using it to verify device identity and health before granting access rather than relying on network location alone. This centrality is precisely what makes ISE an attractive target: a single appliance, once compromised, can influence access decisions across an entire enterprise network rather than a single application or segment.

CVE-2026-76460 arises from insufficient authentication control on an API endpoint exposed by ISE and ISE-PIC. According to Cisco’s advisory, an attacker can send a specially crafted request to this endpoint to bypass the product’s web-based management interface without supplying any credentials [1][2]. Multiple outlets reporting on the disclosure describe the flaw as affecting the product “regardless of configuration,” meaning that standard hardening measures applied to the management interface do not appear to mitigate the exposure on their own [2]. The vulnerability affects Cisco ISE and ISE-PIC releases 3.0 through 3.5, a range that spans several years of shipping versions, suggesting a sizable installed base, though neither Cisco nor CISA has published deployment figures [3][5]. Cisco has released fixes in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, and it has advised customers still running the unsupported 3.0 branch to migrate to a supported, patched release rather than expecting a backported fix [1][3].

The timeline of disclosure compressed an already narrow response window. CISA added CVE-2026-76460 to its KEV catalog on September 16, 2026, alongside a second, unrelated flaw in Acronis Backup software, and cited both as vulnerabilities with confirmed evidence of active exploitation [4]. Cisco’s own public advisory followed on September 17, 2026 — a sequencing that means defenders monitoring CISA’s KEV catalog would have learned of active exploitation a full day before Cisco’s vendor advisory was available. This sequencing echoes a pattern CSA has documented in two other 2026 disclosures: identity and network infrastructure vendors have repeatedly discovered and disclosed vulnerabilities only after exploitation was already underway, leaving defenders to work backward from indicators of compromise rather than forward from a proactive patch cycle [6][7]. CSA’s prior research notes on the Palo Alto Networks GlobalProtect authentication bypass (CVE-2026-0257) and the Cisco Catalyst SD-WAN root-access flaw (CVE-2026-20245) document these two instances of rapid, pre- or near-disclosure exploitation against network and identity boundary devices [6][7].

Security Analysis

The technical mechanism behind CVE-2026-76460 fits a class of vulnerability that CSA has tracked repeatedly across network and identity appliances in 2026: a privileged management or API surface that fails to enforce authentication consistently with the rest of the product. Cisco’s advisory characterizes the root cause as “incorrect use of privileged APIs,” language that suggests an internal API intended for authenticated administrative functions was reachable, or effectively reachable, without the caller first proving its identity [4][5]. Because ISE’s management interface governs configuration of network access policy, an attacker who reaches this API without authentication inherits the same level of control an administrator would normally need credentials to obtain. Cisco’s advisory further indicates that successful exploitation grants command execution with root privileges, which is a materially more severe outcome than gaining read access to configuration data; a root shell on the appliance gives an attacker the ability to modify access policy, exfiltrate stored credentials and certificates, and manipulate or delete forensic logs to conceal the intrusion [1][3].

That capacity for evidence tampering is significant for incident response. Cisco’s guidance advises administrators to inspect access logs for suspicious usernames, including generic placeholders such as “dummyuser,” but also cautions that an attacker with root access can remove or alter these very logs [1]. This creates a forensic asymmetry: defenders who rely solely on ISE’s own logging to determine whether they were compromised may reach a false negative if the attacker has already covered their tracks. Organizations should therefore treat any internet-reachable or otherwise exposed ISE deployment as a candidate for compromise assessment even in the absence of clear log evidence, and should cross-reference ISE activity against independent telemetry such as network flow data, firewall logs, and endpoint detection tooling on the appliance’s host, where available.

The blast radius of an ISE compromise extends well beyond the appliance itself because of the role ISE plays in network segmentation and access enforcement. An attacker who controls policy decisions at the identity layer can potentially grant compromised or attacker-controlled endpoints access to network segments that were previously off-limits, effectively unwinding the segmentation that ISE was deployed to enforce. In organizations that have built Zero Trust architectures around ISE as the policy decision point, this vulnerability represents a direct attack on the trust anchor of that architecture rather than a peripheral system compromise. This dynamic mirrors a broader theme CSA has observed across recent identity and network boundary disclosures: security architectures that concentrate policy enforcement in a single platform gain consistency and manageability, but they also concentrate risk, such that the compromise of that one platform can have consequences disproportionate to its footprint [6][7].

The absence of a workaround compounds the urgency. Cisco has stated plainly that no configuration-based mitigation exists for CVE-2026-76460, in contrast to some prior boundary-device disclosures where administrators could disable a specific feature or restrict a listening interface as an interim measure [1][3]. This leaves patching, and in some cases network-level access restriction to the ISE management plane via infrastructure access control lists, as the only available levers while patches are deployed. Given that Cisco has confirmed active exploitation predates public disclosure, organizations should assume that any unpatched, network-reachable ISE deployment observed after September 17, 2026 has had a meaningful exposure window during which opportunistic or targeted scanning could have identified and attacked it.

Recommendations

Immediate Actions

Security teams operating Cisco ISE or ISE-PIC should confirm their current deployed version against Cisco’s advisory and apply the fixed release for their branch without delay: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 [1][3]. Deployments still running the unsupported 3.0 branch should be treated as unpatchable in place and prioritized for migration to a supported, patched release. Pending patch deployment, administrators should restrict access to the ISE management interface and API endpoints using infrastructure access control lists limited to known administrative source addresses, since Cisco has confirmed no other workaround is available. Every node in a distributed ISE deployment, not only the primary administration node, should be checked and patched, since the vulnerability affects the underlying API rather than a single deployment role.

Short-Term Mitigations

Incident response teams should review access and application logs across all ISE nodes for indicators consistent with exploitation, including unfamiliar or generic usernames in authentication events, while recognizing that an attacker with root access may have altered or deleted these logs to conceal activity. Where log tampering is suspected or cannot be ruled out, organizations should treat the affected node as potentially compromised and consider re-imaging it from a known-good baseline after patching, rather than relying solely on log review to clear it. Network and firewall logs adjacent to ISE nodes should be cross-referenced for unusual outbound connections or data transfers that might indicate exfiltration of configuration data, certificates, or credentials. Organizations should also review downstream network access policy for unexpected changes, since an attacker who compromised ISE’s policy engine could have altered segmentation rules to preserve access even after the initial vulnerability is patched.

Strategic Considerations

Beyond immediate remediation, this incident is a reminder that identity and policy infrastructure deserves the same boundary-device scrutiny that organizations increasingly apply to VPN concentrators and firewalls, rather than being treated as internal, implicitly trusted infrastructure. Enterprises should evaluate whether their ISE deployment, or equivalent network access control platforms, is reachable from network segments broader than strictly necessary for administrative and policy-enforcement functions, and should apply network segmentation to the management plane of identity infrastructure itself. Organizations building or maturing Zero Trust architectures should also assess the resilience of their model to the compromise of the policy decision point, since concentrating enforcement logic in one platform, while operationally efficient, creates a high-value target whose failure mode is broader than that of any single enforced resource. Finally, this disclosure adds to a growing pattern of 2026 vulnerabilities in network and identity boundary devices exploited before or immediately upon disclosure, reinforcing the case for continuous, assumption-of-breach monitoring of these systems rather than periodic, patch-cycle-driven assessment alone.

CSA Resource Alignment

This incident connects most directly to two recent CSA research notes analyzing actively exploited authentication bypasses in network and identity boundary infrastructure. CSA’s research note on PAN-OS GlobalProtect Auth Bypass: Active NGFW Exploitation, covering CVE-2026-0257, documents a closely analogous pattern: a boundary authentication mechanism failing under a narrow set of exploitable conditions, exploited within days of disclosure, and remediated under a compressed CISA KEV deadline. The mechanics differ, an override-cookie trust failure versus an unauthenticated API endpoint, but the operational lessons around exposure-window management, log-based detection limitations, and KEV-driven prioritization apply directly to the ISE case. CSA’s research note on Cisco SD-WAN CVE-2026-20245 Zero-Day: Root Access Pre-Disclosure Exploitation is even more directly comparable, given that it examines a Cisco management-plane vulnerability, also within 2026, that granted root-level access and was exploited before a patch existed; the persistence and log-tampering risks that note describes for SD-WAN Manager mirror the concerns raised here for ISE.

Because ISE is frequently deployed as the enforcement point for Zero Trust network access, this incident also underscores the guidance in CSA’s Zero Trust Principles and Guidance for Identity and Access Management (IAM), which emphasizes that Zero Trust architectures must account for the compromise of their own policy decision points, not only the resources those points protect. Organizations mapping this incident to a broader control framework should reference the AI Controls Matrix (AICM) v1.1, which includes an Identity and Access Management domain broadly relevant to authentication assurance and privileged interface controls, and a Threat and Vulnerability Management domain broadly relevant to time-bound remediation of actively exploited flaws; the AICM is available from CSA at its public artifact page.

References

[1] The Hacker News. “Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks.” The Hacker News, September 17, 2026.

[2] BleepingComputer. “Cisco warns of max severity ISE zero-day exploited in attacks.” BleepingComputer, September 17, 2026.

[3] Help Net Security. “Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460).” Help Net Security, September 17, 2026.

[4] Cybersecurity and Infrastructure Security Agency. “CISA Adds Two Known Exploited Vulnerabilities to Catalog.” CISA, September 16, 2026.

[5] Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog.” CISA, accessed September 17, 2026.

[6] Cloud Security Alliance AI Safety Initiative. “PAN-OS GlobalProtect Auth Bypass: Active NGFW Exploitation.” Cloud Security Alliance, 2026.

[7] Cloud Security Alliance AI Safety Initiative. “Cisco SD-WAN CVE-2026-20245 Zero-Day: Root Access Pre-Disclosure Exploitation.” Cloud Security Alliance, June 27, 2026.

[8] Cloud Security Alliance. “Zero Trust Principles and Guidance for Identity and Access Management (IAM).” Cloud Security Alliance, 2024.

[9] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, 2026.