Critical Cisco ISE Authentication Bypass (CVE-2026-76460) Under Active Exploitation

What Are the Key Points?

The advisory discloses an unauthenticated remote code execution vector targeting core network access control infrastructure:

• Unauthenticated API Exploitation: The issue is caused by weak authentication controls on certain Cisco ISE API endpoints. A malicious user could send specially designed HTTP requests to get around the authentication process.
• Full Root Compromise: Successful exploitation grants unauthenticated attackers access to the web-based management interface and command execution with root privileges on the underlying operating system.
• Active In-the-Wild Exploitation: Confirmed actively exploited in target environments; the vulnerability was originally discovered during a Cisco Technical Assistance Center (TAC) support engagement.
• Zero Workarounds Available: Cisco explicitly notes that no official workarounds exist to resolve the vulnerability.

What Is the Impact on Enterprise Security?

1. Network Authentication Breakdown: Cisco ISE acts as the central policy decision point for enterprise enterprise Zero Trust, NAC, and 802.1X environments. A root-level compromise allows threat actors to tamper with access policies or pivot across the corporate network.
2. Forensic Evasion Risks: Because attackers obtain root privileges, Cisco warns that threat actors can tamper with local logs and remove indicators of compromise (IoCs) to conceal their presence.
3. Mandatory Federal Remediation: CISA’s KEV addition mandates federal civilian agencies to remediate or isolate affected instances under Binding Operational Directive (BOD) guidelines.

What Should You Do? (Actionable Steps)

[ 1 ] Audit Deployment Logs: Review `access.log` files across all ISE nodes for suspicious usernames or anomalies. Run the CLI verification command:`admin show logging application ise-kong/access.log | include dummyuser`
[ 2 ] Cross-Check External Logs: Validate perimeter firewall and egress network logs for unexpected outbound transfers or suspicious command-and-control (C2) connections initiated from ISE IP addresses.
[ 3 ] Apply Infrastructure ACLs (Mitigation): Restrict management and control plane access exclusively to trusted administrative subnets using infrastructure ACLs (iACLs).
[ 4 ] Upgrade to Fixed Releases: Deploy the official software patch corresponding to your release train:

Cisco ISE Fixed Software Matrix