CVE-2026-76460: Cisco Identity Services Engine — Critical Authentication Bypass Exploited (June 2024)

CVE-2026-76460 — Cisco Identity Services Engine

CVE-2026-76460 is a critical authentication bypass vulnerability in Cisco Identity Services Engine (ISE), assigned a maximum CVSS score of 10. This flaw is actively exploited and allows attackers to gain unauthorized access to network devices managed by ISE, bypassing standard authentication controls.

Attack Vector

The vulnerability stems from improper endpoint validation in ISE's API authentication routines. An attacker can craft malicious API requests that exploit these insufficient checks, granting themselves access as if they were a legitimate user. No prior authentication or special privileges are required, and exploitation can occur remotely if the API is exposed. There are no known indicators of compromise (IOCs) specific to this CVE at this time, but exploitation has been confirmed in the wild.

Who Is at Risk

All organizations running Cisco Identity Services Engine are at risk, regardless of deployment size or sector. Cisco has confirmed exploitation in the wild, and the vulnerability affects all supported ISE versions prior to the patched release. Enterprises with externally accessible ISE APIs are at highest risk, but internal deployments are also vulnerable if an attacker gains network access.

Patch & Mitigate

• Patch: Apply the official Cisco ISE security update released June 2024 immediately. Refer to Cisco's advisory for exact version numbers.
• Workaround: No effective workaround is available. Restrict API access at the network level as a temporary measure.
• Detect: Audit ISE logs for unexpected API calls, especially authentication events from unusual IPs or at odd hours. Monitor for new device registrations or policy changes without corresponding admin activity.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers leverage exposed APIs to gain unauthorized entry.
• T1190 — Exploit Public-Facing Application: The vulnerability is exploited via ISE's public API endpoints.

Source: https://isc.sans.edu/podcastdetail/10098