CVE-2026-76460 · Low · CISA KEV

Cisco ISE Vulnerability: Unauthenticated Remote Access Bypass via Privileged API Misuse

Threat Engine Auto-Feed · data current as of 2026-09-17

A critical vulnerability in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to bypass the web-based management interface. This flaw, stemming from incorrect use of privileged APIs, is actively exploited in the wild and listed in CISA KEV. Organizations using Cisco ISE are at high risk of unauthorized device access.

  • CVSS:
  • EPSS percentile:
  • Exploitation pressure: 25/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild). Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability arises from the incorrect use of privileged application programming interfaces (APIs). Essentially, the software uses powerful internal functions in a way that allows an attacker to bypass intended security controls, such as the web-based management login, without needing any authentication.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC)
  • Financial services organizations (targeted by FIN7, LockBit affiliates, APT38)
  • Technology sector organizations (targeted by APT29, Scattered Spider)

Misconfigurations that escalate it

    High-impact scenarios

    • Unauthorized remote access to the affected Cisco ISE device, potentially leading to compromise of network access control policies.
    • Attackers bypassing the web-based management interface, gaining control over identity and access management infrastructure.
    • Potential for lateral movement or further network compromise if ISE manages critical network access.

    Likely adversaries

    • FIN7 — Financial services (Assessed)
    • LockBit affiliates — Financial services (Assessed)
    • APT38 (Lazarus) — Financial services (Assessed)
    • APT29 (Cozy Bear) — Technology (Assessed)
    • Scattered Spider — Technology (Assessed)

    What to do (defensive)

    Detect

    • Monitor Cisco ISE logs for unusual access attempts or unauthorized configuration changes.
    • Implement network segmentation to limit exposure of ISE management interfaces.
    • Regularly review access logs for the web-based management interface for anomalies.

    Contain

    • Isolate affected Cisco ISE devices from the network if unauthorized access is detected.
    • Restrict network access to the Cisco ISE management interface to only trusted administrative subnets.

    Patch

    • Apply vendor-provided security patches for Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) as soon as they become available.

    Frontier verdict — Low

    This vulnerability is critical due to active exploitation in the wild (CISA KEV) allowing unauthenticated remote access to Cisco ISE, necessitating immediate patching.

    For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.