DaystoPatch

CiscoExploited incident

Cisco Identity Services Engine Authentication Bypass Vulnerability

CVE-2026-76460Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 16 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fixUnverified source
Follow-through
0h
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5CuratedQuote not checked yet

    The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

    Exploitation was first disclosed by this advisory; timestamp is its 'First Published: 2026 September 16 16:00 GMT'. Coverage (Help Net Security 2026-09-17, BitSight, TechRadar) followed; no earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CISA KEV (CVE-2026-76460)ClaimedQuote verified16 Sep 2026

    Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

    Added to CISA's KEV catalog on 2026-09-16.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet16 Sep 2026, 17:27 UTC

    An exploited Cisco ISE vulnerability (CVE-2026-76460) allows remote root access. Patch this critical Cisco ISE vulnerability to secure networks.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet16 Sep 2026, 17:27 UTC

    An exploited Cisco ISE vulnerability (CVE-2026-76460) allows remote root access. Patch this critical Cisco ISE vulnerability to secure networks. # Cisco # CiscoISE # CVE202676460 # Cybersecurity # InfoSec https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-76460ClaimedQuote verified16 Sep 2026, 20:12 UTC

    A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:56ad33c89f006ea1…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5CuratedQuote verified

    First Published: 2026 September 16 16:00 GMT

    Cisco's advance notification cisco-sa-notice-jfxK98ZP (v1.0, 2026-09-09 16:00 GMT) announced an ISE 'security hardening release' for September 16 but did not name this vulnerability or mention exploitation, so it is not counted as the vendor acknowledgement.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c06f12d27715f423…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5ClaimedQuote verified16 Sep 2026, 16:03 UTC

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c06f12d27715f423…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    at disclosure

    Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5CuratedQuote verified

    To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device.

    Mitigation in the Workarounds section of v1.0 (the advisory has had no revisions).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c06f12d27715f423…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5CuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    Advisory v1.0 (2026-SEP-16 16:00 GMT) shipped with fixed patches for every train.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c06f12d27715f423…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Cisco PSIRT advisory cisco-sa-ISE-ABP-VNSW7Tn5CuratedQuote verified

    First Published: 2026 September 16 16:00 GMT

    Fixed-release table lists 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4; ISE 3.0 is past End of Software Maintenance (migrate). Version 1.0 is the only version, so all supported trains were fixed at first publication.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c06f12d27715f423…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Cisco ISE authentication bypass exploited; fixed in latest ISE patches

Attackers have exploited a maximum-severity flaw in Cisco Identity Services Engine that lets an unauthenticated person bypass its management login; Cisco released patches when it disclosed the attacks.

In plain words

Cisco Identity Services Engine, which decides which users and devices are allowed onto our network, had a flaw that let an outsider bypass its login and potentially take full control, and Cisco confirmed it was used in real attacks. Cisco rated it the maximum severity and released fixes for all supported versions on 16 September 2026, the same day it announced the problem. If we run ISE, we need to apply the patch for our version and check every node's logs for signs of break-in.

What happened and who is affected

What happened

On 16 September 2026 Cisco disclosed CVE-2026-76460, an authentication bypass in an API of Cisco Identity Services Engine (ISE), scored 10.0 out of 10. A crafted request to the affected API endpoint gives an unauthenticated attacker access to the device, and Cisco warns attackers may obtain root-level command execution. Cisco said it was aware of active exploitation and published fixed patches for all supported releases in the same advisory.

Who is affected

Cisco ISE and ISE Passive Identity Connector (ISE-PIC), regardless of configuration, on 3.1 before Patch 12, 3.2 before Patch 11, 3.3 before Patch 12, 3.4 before Patch 7 and 3.5 before Patch 4. ISE 3.0 is past end of software maintenance and must migrate.

CVE-2026-76460. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2026-76460/

Affected products

  • Cisco Identity Services Engine (ISE)
  • Cisco ISE Passive Identity Connector (ISE-PIC)
How we built this timeline

Part of Cisco's 16 Sep 2026 bundled publication (advance notice cisco-sa-notice-jfxK98ZP, first published 9 Sep 2026 as an 'Interim' notice listing products only). Exploitation was disclosed in the same advisory that shipped fixes, so world = vendor = First fix.

Cisco says the bug was found during the resolution of a Cisco TAC support case. The fixed-release table on the live page shows a footnote marker next to 3.5 while the footnote text is about 3.0 reaching End of Software Maintenance; likely a rendering quirk.

Related

Cisco report card