Cisco ISE CVE-2026-76460: Patch ISE, Then Verify Access

Cisco ISE CVE-2026-76460 is being actively exploited, carries a CVSS score of 10.0, and can ultimately give an unauthenticated attacker root-level command execution.

Organizations using affected Cisco Identity Services Engine or ISE Passive Identity Connector releases should upgrade immediately. But the investigation cannot end there.

Once an attacker may have controlled the system that makes network-access decisions, and may have altered its local evidence, the more important question becomes:

Which access decisions, policies, credentials, and integrations can still be trusted?

Cisco says the vulnerability affects ISE and ISE-PIC regardless of configuration, has no complete workaround, and requires an upgrade to a fixed release. CISA has also added it to the Known Exploited Vulnerabilities catalog.

Key takeaways

What is CVE-2026-76460?

The vulnerability results from insufficient authentication controls in a Cisco ISE API.

An unauthenticated remote attacker can send a crafted request, bypass the web-management authentication boundary, and gain unauthorized access to the affected appliance. Cisco warns that successful exploitation may ultimately provide root-level command execution.

Cisco identifies these first fixed releases:

Cisco ISE 3.0 has reached the end of software maintenance. Organizations still using that branch should migrate to a supported release containing the fix.

These are first fixed releases, not reasons to remain on an older software branch indefinitely. Administrators should follow Cisco’s supported upgrade guidance for their environments.

Why is an ISE compromise different?

ISE may help determine:

• Which users and devices can enter the network.
• What resources they may reach.
• Which administrators can manage infrastructure.
• How RADIUS and TACACS+ requests are handled.
• Which certificates, directories, and network devices are trusted.
• Which events become part of the access audit trail.

Root access does not establish that an attacker changed every policy or compromised every connected system.

It does mean that local configuration and logs can no longer be treated as independent proof that nothing happened.

What should Cisco ISE administrators do?

1. Upgrade every affected node

Inventory production, policy-service, administrative, monitoring, test, disaster-recovery, and legacy nodes.

Install the appropriate fixed release and verify the version from the running system. Do not rely solely on a completed change ticket or management-console status.

Cisco permits infrastructure access-control lists as a temporary mitigation for restricting management and control-plane traffic. It does not consider them a replacement for the security update.

2. Preserve evidence before rebuilding

Cisco recommends inspecting ise-kong/access.log for suspicious usernames and reviewing every node in a distributed deployment.

Preserve relevant support bundles and API-gateway logs. Then correlate them with evidence stored outside ISE, including the sources outlined in 5 Cyber Incident Decisions You Need to Make Before the Attack Happens:

• Firewall and proxy logs.
• DNS and network-flow records.
• SIEM and identity events.
• Privileged-access records.
• Remote-administration activity.
• Unexpected uploads or downloads involving ISE nodes.

Cisco specifically warns that an attacker with root access may remove or hide indicators on the affected system.

3. Reconstruct the access timeline

Do not investigate only the initial API request.

Review the exposure period for:

• Unexpected policy changes.
• New or modified administrator accounts.
• Changes to network-device definitions.
• Unusual RADIUS or TACACS+ activity.
• Unexpected privileged network sessions.
• Certificate or identity-source changes.
• Authorization outcomes that do not match normal business activity.
• Differences between the running configuration and a known-good baseline.

This determines whether the incident affected only the appliance or the access decisions the appliance produced.

4. Replace exposed authority

If compromise is suspected, review and rotate:

• Administrative credentials.
• Service accounts.
• API and integration secrets.
• Directory credentials.
• Relevant certificates and private keys.
• Credentials used to manage connected network devices.

Revoke authority at the system that issued it. Merely changing a stored value on ISE may not invalidate a credential that remains active elsewhere.

5. Reimage when malicious activity is suspected

Cisco strongly recommends reimaging affected nodes and restoring configuration from backup when malicious activity is suspected.

Before restoration, confirm that the backup predates the compromise and does not reintroduce attacker-created accounts, altered policies, or exposed secrets.

The Infonaligy perspective

Identity infrastructure deserves a higher recovery standard than an ordinary application server.

Calling all five activities “patching” hides the most consequential part of the incident.

Infonaligy’s SOC Services and Threat and Vulnerability Assessments help organizations connect vulnerability remediation with monitoring, exposure analysis, incident evidence, and business risk.

Frequently asked questions