Build1 publisher2 min readPublished
A CVSS 10.0 bypass hands ISE admin access to anyone who can route to the REST API
Cisco disclosed an unauthenticated authorization bypass in the Identity Services Engine REST API on 16 September. Because the request never presents a credential, it leaves just one trace: a privileged API call that succeeded.
The Engineer · Build desk
What happened
- Cisco disclosed CVE-2026-76423 on 16 September 2026, an authentication bypass in the Identity Services Engine REST API carrying a CVSS v3 score of 10.0.
- An unauthenticated remote attacker who can reach the interface obtains administrative access, which Cisco's advisory attributes to the REST API web service being exposed with insufficient authorization checks.
- The same release cycle carried four more flaws, including an insecure deserialization bug scored 9.9 that yields remote code execution and a 9.1 SQL injection in the SXP REST API.
- Cisco lists Identity Services Engine releases 3.1, 3.2, 3.3, 3.4 and 3.5 as impacted, along with the ISE Passive Identity Connector.
- Cisco says the issues were found in internal security testing using existing processes as well as frontier AI models, and has not reported malicious exploitation of these specific CVEs.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Until the fixed build lands, routing is the only control available. Cisco's guidance calls for an access control list limiting the management interfaces to trusted internal subnets, so containment sits in the firewall team's change queue.
- decision Administrative access to ISE is authority over admission policy, identity records and the integrations with switches and wireless controllers, so after patching you diff current policy against a known-good state.
- exposure Pairing the bypass with the deserialization flaw takes an attacker from API access to the operating system, putting configuration files and stored credentials on the appliance within reach.
- cost Cisco flags denial-of-service conditions in this cycle that stop unauthenticated endpoints reaching business networks, so where ISE gates admission, users end up unable to get on the wire.
The defect sits in authorization. According to the dev.to analysis, the attacker sends a request to the affected REST API endpoint and the service processes it without establishing that the caller holds the required role [7]. There is no password to guess and no hash to crack [6]. The same write-up states the forensic consequence plainly. Authentication is never attempted, so failed logins are the wrong place to look; a defender has to hunt for successful privileged API activity that has no legitimate owner [8].
Everything else depends on reachability. ISE management interfaces normally sit on a management network, so start with who can route to them. The dev.to author lists flat internal networks, permissive firewall rules, broad VPN access and accidental internet exposure as conditions that satisfy the precondition [9]. The command injection flaw in the same cycle, CVE-2026-20305, needs an authenticated position first. The author expects it to appear as post-compromise escalation instead of an initial access vector [10].
The scoping number in the write-up comes from a ZoomEye query. `app="Cisco Identity Services Engine"` returns 883,616 assets matching the product fingerprint. The author is careful to say the query does not identify which assets are unpatched or whether their management interfaces are reachable from untrusted networks [17]. A CVE-indexed query, `vul.cve="CVE-2026-76423"`, returned zero results at the time of writing, which the author attributes to newly published CVEs not yet being indexed against assets [18]. Zero out of 883,616 is nought percent of the fingerprinted population [2]. For the big number to say anything about your exposure, the fingerprint would have to correlate with management-plane reachability, and the author's own caveat says otherwise [17].
Fixes land per release train: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4 [15]. That is four distinct patch numbers across five impacted trains [3], so a site running two of them has two target builds to schedule. Two of the five CVEs named in the cycle score 10.0 [1].
What to watch
- Cisco updating the advisory to report exploitation in the wild.
- Scanners indexing CVE-2026-76423 against assets, turning the zero-result query into a count of exposed vulnerable hosts.
- A public exploit chain pairing the bypass with CVE-2026-20307 to reach operating system access on the appliance.