Unauthenticated REST API authorization bypass grants admin access to Cisco ISE and ISE-PIC (CVE-2026-76423)
Cisco published fixes on 2026-09-16 with no workaround, and BleepingComputer and The Hacker News report in-the-wild exploitation of the ISE REST API authentication bypass, so an unpatched ISE hands an outside attacker administrative control of the system that decides who gets on your network.
The Cisco ISE / ISE-PIC REST API web service is exposed with insufficient authorization checks, so a remote attacker with no credentials can send a crafted HTTP request to the REST API port and read or modify ISE configuration and identity data with administrative privileges. The same advisory bundles further ISE flaws enabling remote code execution, SQL injection and XXE.
Affected: Cisco Identity Services Engine 3.1.0 (base through patch 6); Cisco Identity Services Engine 3.2.0 (base through patch 2); Cisco ISE Passive Identity Connector (ISE-PIC) on the same releases
How to Test
Check the running ISE / ISE-PIC release and patch level against the affected list (3.1.0 through 3.1.0 p6, 3.2.0 through 3.2.0 p2). Determine whether the REST API port is reachable from untrusted networks, then review web-server and audit logs for unauthenticated or unexpected requests to the REST API and for administrative configuration or identity-store changes you did not make.
How to Patch
Upgrade to the fixed ISE / ISE-PIC software Cisco lists in advisory cisco-sa-ise-multi-hrP9jQSQ for the 3.1 and 3.2 trains; Cisco states there are no workarounds. Until the upgrade is applied, restrict network access to the ISE REST API port to trusted management hosts only.