Cisco ISE auth-bypass flaw: CISA's patch deadline has passed

A maximum-severity vulnerability in Cisco Identity Services Engine has now missed its federal patching deadline. CVE-2026-76460, an unauthenticated authentication bypass affecting an ISE and ISE-PIC API, carries a CVSS score of 10.0. Cisco disclosed it on 16 September 2026 and confirmed active exploitation; the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day, giving federal civilian agencies until 19 September to remediate — one of the shortest windows CISA has issued this year. That date has now passed.

What the flaw allows

Cisco says the bug stems from insufficient authentication control on an API endpoint: a specially crafted request bypasses login entirely, regardless of configuration. From there, an attacker can reach privileged functions and ultimately execute commands with root privileges, exposing or altering the identity and configuration data ISE holds for network access control, VPN posture checks and guest onboarding. Cisco found the issue while resolving a support case and has stated there is no workaround — the only remediation is the vendor patch.

Patch and mitigate

Cisco's fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. ISE 3.0 has reached end of software maintenance and has no fix; those deployments need to migrate to a supported train. Until every node is patched, Cisco recommends restricting management-plane exposure with infrastructure access control lists as a partial, temporary risk reduction — not a substitute for patching.

Checking for prior compromise

Because a successful exploit can grant root access, an attacker may be able to remove or alter local evidence. Cisco advises reviewing the ise-kong/access.log on every node for suspicious usernames, and correlating findings against external firewall logs and NetFlow data rather than relying solely on the appliance's own records. If compromise is suspected, the safer path is to re-image the node and restore configuration from a known-good backup.

This CVE is distinct from the separate flaws disclosed the same week in Cisco FMC and Secure Email Gateway — treat each on its own patch ladder rather than assuming one fix covers the others. For any organization running ISE past the missed deadline, the sequence is the same: patch every node now, restrict management access in the meantime, and run the log review before declaring the incident closed.

Sources: Cisco Security Advisory, BleepingComputer, SOCRadar.