Build 2 publishers2 min readPublished September 19, 2026 at 5:00 PM PDT

A crafted request to one Cisco ISE API endpoint reaches root without a credential

Cisco's PSIRT says CVE-2026-76460 is being exploited, and the company has published no workaround, so the fix is a branch-specific patch. ISE 3.0 is past End of Software Maintenance and gets a migration.

The Engineer · Build desk

Illustration accompanying A crafted request to one Cisco ISE API endpoint reaches root without a credential

What happened

Cisco disclosed on September 16, 2026 that CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine, lets an unauthenticated remote attacker gain root privileges on the appliance.
Cisco's PSIRT confirmed the flaw is being exploited in the wild, and the company says it found the defect while working a Technical Assistance Center support case.
A crafted network request to the exposed endpoint executes commands as root without a credential, and it never passes through the web management interface.
Affected products are Cisco ISE and ISE-PIC in all device configurations, across releases 3.1 through 3.5.

Compiled by The EngineerSomething wrong?How this is made

Why it matters

constraint Cisco's guidance offers one pre-patch control: an infrastructure access control list keeping untrusted traffic away from ISE management interfaces. That is a network change.
decision Anyone still running ISE 3.0 has to pick a supported branch and schedule a migration while exploitation is confirmed, and that decision cannot be made inside a patch window.
exposure Root on ISE puts the attacker in charge of network admission policy for everything that trusts it, so access rules and internal subnets become reachable from an unauthenticated network position.
exposure Because the advisory says attackers can erase log entries, clean logs do not clear an appliance, and the dummyuser account entries Cisco flags are the detection defenders are handed.

"Insufficient authentication control on an API endpoint" is the entire technical description in Cisco's advisory ^[4]. Read literally, that means the endpoint answers before it establishes who is calling. The request never goes through the web management interface, so the admin roles and whatever MFA sits in front of the ISE web console never see it ^[5].

Cisco found the defect while working a Technical Assistance Center support case, and the dev.to write-up takes that provenance as a sign of real-world activity ^[3]. A support case is an unusual way to find your own CVSS 10.0.

The fixes are branch-specific, and there are five of them: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 ^[9]^[21]. Cisco lists no patch for the 3.0 line, because that release reached End of Software Maintenance, and Cisco advises customers on it to migrate to a supported release that includes the fix ^[13]. Cisco's own remediation language is blunt: the advisory "strongly recommends that customers upgrade to the fixed software indicated in this advisory" ^[14], and it treats any workaround or mitigation as a temporary solution until that upgrade happens ^[19].

Cisco's PSIRT validates only the affected and fixed release information documented in the advisory ^[15]. The write-up's reference list also includes a CISA alert adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on September 16, 2026 ^[20].

The exposure figure in circulation comes from a scanner. The dev.to write-up reports 4,051 instances worldwide for the product fingerprint app="Cisco ISE", and 0 for a filter on vul.cve="CVE-2026-76460", which it attributes to ZoomEye not yet indexing the new identifier ^[16]^[17]. The same write-up says the product count describes assets matching the fingerprint and does not confirm that every one is vulnerable ^[18]. For it to be a count of exploitable targets, every match would have to be a live ISE on 3.1 through 3.5, unpatched, with the vulnerable endpoint reachable from wherever the scanner sat ^[7].

What to watch

A CISA remediation due date attached to the KEV entry would turn vendor advice into a fixed clock for federal ISE operators.
If Cisco adds a workaround or explicit ACL guidance to the advisory, the pre-patch options change for estates that cannot upgrade this week.
A version-resolved scan count that separates patched from unpatched ISE hosts would replace the 4,051 fingerprint figure with something usable.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
On September 16, 2026, Cisco disclosed that CVE-2026-76460, a maximum-severity flaw in Cisco Identity Services Engine, is being exploited in the wild; it carries a CVSS score of 10.0 and lets an unauthenticated remote attacker bypass authentication on an API endpoint and gain root privileges on the appliance.
ReportedSupported2 sources— sign in to open View cited source
[2]
Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation of CVE-2026-76460.
ReportedSupported2 sources— sign in to open View cited source
[3]
Cisco discovered the defect while working a Technical Assistance Center support case, which the write-up says suggests real-world activity rather than a purely theoretical finding.
ReportedSupported2 sources— sign in to open View cited source
[4]
The advisory states that the flaw stems from "insufficient authentication control on an API endpoint."
ReportedSupported2 sources— sign in to open View cited source
[5]
An attacker sends crafted network requests directly to an exposed API endpoint; because the endpoint's authentication control is insufficient, the request bypasses the web management interface entirely, no prior authentication is required, and the attacker can then execute commands with root privileges on the underlying system.
ReportedSupported2 sources— sign in to open View cited source
[6]
ISE enforces identity and access policy across enterprise networks, so an attacker who owns the appliance can manipulate access rules and pivot deeper into internal subnets.
ReportedSupported2 sources— sign in to open View cited source
[7]
The vulnerability affects Cisco ISE and Cisco ISE-PIC across all device configurations, with affected releases running from 3.1 through 3.5.
ReportedSupported2 sources— sign in to open View cited source
[8]
The advisory notes that attackers can erase log entries to conceal their activity, complicating post-incident forensics.
ReportedSupported2 sources— sign in to open View cited source
[9]
Cisco released fixed releases 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4.
ReportedSupported2 sources— sign in to open View cited source
[10]
Cisco has not published a temporary workaround for CVE-2026-76460.
ReportedSupported2 sources— sign in to open View cited source
[11]
Defenders can reduce exposure by using infrastructure access control lists to block untrusted traffic from reaching ISE management interfaces.
ReportedSupported2 sources— sign in to open View cited source
[12]
Teams should review access logs for suspicious dummyuser account entries, which the advisory flags as an indicator worth checking.
ReportedSupported2 sources— sign in to open View cited source
[13]
Cisco ISE Software Release 3.0 has reached End of Software Maintenance, and customers are advised to migrate to a supported release that includes the fix for this vulnerability.
ReportedSupported2 sources— sign in to open View cited source
[16]
A ZoomEye query for the product fingerprint app="Cisco ISE" returned 4,051 matching instances globally.
ReportedSupported2 sources— sign in to open View cited source
[17]
A separate ZoomEye CVE filter, vul.cve="CVE-2026-76460", returned 0, which the write-up says is expected for a recently disclosed CVE that ZoomEye has not yet indexed under that identifier.
ReportedSupported2 sources— sign in to open View cited source
[18]
The write-up states that the product-query count describes assets matching the Cisco ISE fingerprint and does not confirm that every one of those assets is vulnerable to this specific CVE.
ReportedSupported2 sources— sign in to open View cited source
[14]
"To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory."
ReportedSupportedView cited source
[15]
"The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory."
ReportedSupportedView cited source
[19]
Cisco considers any workarounds and mitigations to be temporary solutions until an upgrade to a fixed software release is available.
ReportedSupportedView cited source
[20]
The write-up's reference list includes a CISA alert dated September 16, 2026, adding two known exploited vulnerabilities to CISA's catalog.
ReportedSupportedView cited source
[21]
The fix list covers five release branches, one patch level each, and contains no fixed release for the 3.0 line.
DerivedSupported2 sources— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

cisco.com
1 article · September 18, 2026
Cisco Identity Services Engine Authentication Bypass Vulnerability - Cisco
dev.to
2 articles · September 19, 2026
Cisco ISE Authentication Bypass CVE-2026-76460: What Defenders Need to Do Now

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

One sentence in this story is about code, and both dev.to posts quote it: Cisco puts the cause at "insufficient authentication control on an API endpoint". The structure worth noticing is that the web management interface does check the caller and the API endpoint beside it does not, so a crafted request skips the console and executes commands as root. No proof of concept, vulnerable route or patch diff appears anywhere in our coverage. The fix spans 3.1 through 3.5 with one patch level per branch. That spread means the defect was present in every supported line of the product.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence72

0100

Vendor table firm, urgency single-chain

Cisco's own page carries the fix table and the 3.0 migration note, so the remediation half of this story rests on the primary document. The 10.0 score, the exploitation confirmation, the Technical Assistance Center origin and the dummyuser indicator all come from the two dev.to write-ups, and the fuller one credits a SecurityOnline.info report for the advisory text it is summarising. Both posts trace back to the same upstream material, so together they amount to one confirmation, not two.

Adoption42

0100

Exposure counted, patch uptake unknown

The only measured quantity is 4,051 hosts matching the Cisco ISE fingerprint on ZoomEye, and both write-ups say a fingerprint match is not a vulnerable asset. Patches exist for five branches; how many of those hosts have taken one is measured nowhere in our coverage. Confirmed exploitation means the risk is real rather than hypothetical, and the 3.0 population sits outside the patch path entirely.

Hype gap+6

−100 understated0 aligned+100 overstated

Close to the advisory, with one loose figure

Both developer posts stay inside the advisory's own claims, including the inconvenient part: the CVE filter returns zero, and they explain why instead of dropping it. The mild overstatement is the 4,051 sitting next to maximum-severity language, where a reader can take it as a count of exploitable appliances. The CISA catalog link is the other loose end, dated the same day and adding two entries that nobody in our coverage ties to this identifier.

Incentives38

0100

Vendor document at the centre

The document everything else summarises is Cisco's, and it points to one remedy: upgrade to the fixed software, with any workaround treated as temporary by policy. Cisco also confines itself to validating the affected and fixed release information it published, which narrows what the advisory can be held to later. The two write-ups are individual practitioner posts, and neither sells a product against the flaw.

Confidence68

0100

Firm on patches, thinner on exploitation

Patch levels, affected branches and the 3.0 position are as firm as vendor text gets. The exploitation claim, which is what sets the clock for anyone running ISE, comes to us through developer posts rather than the Cisco section we hold, and no second vendor or national CERT in our coverage confirms it independently.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

build
A CVSS 10.0 bypass hands ISE admin access to anyone who can route to the REST API
1 publisher
build
A prohibited leading character in a RouterOS username rewrites the session's policy mask
1 publisher
build
A crafted HTTP request runs commands as root on unpatched Cisco ISE nodes
1 publisher
security
Cisco Patches 44 CVEs Across ISE, FMC, Nexus Dashboard; Separately Warns of Exploited ISE Authentication Bypass Zero-Day
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources