Unauthenticated API request bypasses Cisco ISE management authentication (CVE-2026-76460)
Cisco published the advisory and fixes on 2026-09-16 after the flaw was exploited as a zero-day, and CISA added it to KEV the same day with a 2026-09-19 remediation deadline, so a team that leaves an affected ISE node reachable without upgrading is exposed to unauthenticated takeover of its access-control plane.
An API endpoint in Cisco Identity Services Engine and ISE Passive Identity Connector lacks sufficient authentication control, so a remote attacker who sends a crafted request can bypass the web-based management interface and gain unauthorized access to the device, regardless of configuration. ISE sits at the centre of network access control, so control of it exposes the policies and credentials that govern the rest of the network.
Affected: Cisco Identity Services Engine 3.1.0 p8, p9, p10; Cisco Identity Services Engine 3.2.0 p7; Cisco Identity Services Engine 3.3 Patch 1, Patch 2, Patch 3, Patch 4; Cisco Identity Services Engine 3.4.0 and 3.4 Patch 1; Cisco ISE Passive Identity Connector (ISE-PIC) on the same releases
How to Test
Confirm the installed ISE / ISE-PIC release and patch level against the affected list (3.1.0 p8–p10, 3.2.0 p7, 3.3 Patch 1–4, 3.4.0, 3.4 Patch 1); the flaw applies regardless of device configuration, so any node on those releases is vulnerable. Review web/API access logs on ISE admin nodes for unauthenticated requests to API endpoints from unexpected sources, and audit administrator sessions, newly created admin accounts, and policy or configuration changes since the advisory date for activity you cannot attribute.
How to Patch
Upgrade to the fixed ISE / ISE-PIC software Cisco released on 2026-09-16 for your release train (advisory cisco-sa-ISE-ABP-VNSW7Tn5, bug CSCww39530); Cisco states there are no workarounds. Until the upgrade is applied, restrict network reachability of the ISE administrative and API interface to trusted management networks only.