CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
CVE-2026-76460 is a critical vulnerability (CVSS 10.0) in Cisco Identity Services Engine, published September 16, 2026. CISA lists it as known to be exploited, since September 16, 2026. EUVD reports exploitation since September 16, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.6%, the 99th percentile. No source names a fixed version.
- Severity
- 10.0 CriticalCVSS 3.1, CVE List
- Exploit chance
- 75.6%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Discussion
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | S3v3n-JG/CVE-2026-76460 | 2026-09-17 |
| Nuclei | Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass |
What each source reports
CVE List Score used
Cisco Identity Services Engine Authentication Bypass Vulnerability
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- Record
CVE-2026-76460- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-648
- Updated
- 2026-11-02
EUVDEUVD-2026-81122
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- Record
EUVD-2026-81122- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-25wc-3w28-q6vw
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated,...
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- Record
GHSA-25wc-3w28-q6vw- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-648
- Updated
- 2026-11-02
CISA KEVNo score
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- Record
CVE-2026-76460- Weakness
- CWE-648
- Updated
- 2026-11-02
NVD
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
- Record
CVE-2026-76460- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-648
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.