CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs

Exploited in the wild Critical 10.0 Published 16 Sep 2026 Updated 7 Oct 2026

Unauthenticated remote attackers can bypass authentication on Cisco ISE API endpoints to gain unauthorized access to the management interface.

Exploited in the wild: Since 16 Sep 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-76460?

CVE-2026-76460 is a critical authentication bypass vulnerability in Cisco Identity Services Engine, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Weakness: CWE-648

Which versions are affected by CVE-2026-76460?

It affects 2 products.

Products include Cisco Identity Services Engine, Cisco Identity Services Engine Passive Identity Connector.

How do I fix CVE-2026-76460?

No fix has been published for CVE-2026-76460 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Sep 2026.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-76460 being exploited?

Yes. Attackers have exploited CVE-2026-76460 in the wild since at least 16 Sep 2026.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-25wc-3w28-q6vw.