Cisco ISE authentication bypass exploited, patch now

Cisco ISE authentication bypass is being exploited in the wild, Cisco has warned, and the flaw carries the highest severity score the company uses. Tracked as CVE-2026-76460, it has a CVSS score of 10.0 (CVSS, the Common Vulnerability Scoring System, is an industry scale from 0 to 10 that rates how serious a security flaw is), and it allows an unauthenticated, remote attacker to bypass authentication. In plain terms, an attacker who holds no account and no password on the device can get past its login from somewhere else on the network. The affected product is Cisco Identity Services Engine (ISE), a platform organizations use to decide which people and which devices are allowed onto their networks, together with Cisco ISE Passive Identity Connector (ISE-PIC), a companion component that helps the same platform identify users.

Cisco said the problem comes from insufficient authentication control on an API endpoint. An API is the software interface that lets one program talk to another, and here that interface was not checking identities properly. According to Cisco, an attacker can exploit the flaw by sending a specially built request to an affected API endpoint, and a successful exploit can give the attacker unauthorized access to the device by bypassing its web-based management interface. Cisco stated that the issue affects ISE and ISE-PIC regardless of how the device is configured, so there is no particular setting that protects customers. Fixes have been released in the following versions: version 3.1 is fixed in 3.1 Patch 12, version 3.2 in 3.2 Patch 11, version 3.3 in 3.3 Patch 12, version 3.4 in 3.4 Patch 7, and version 3.5 in 3.5 Patch 4. Cisco said it is aware of active exploitation and urged customers to upgrade to a fixed software release to counter the threat. The company did not share details about the nature of the attacks taking advantage of the flaw, or about who is behind them.

As indicators of compromise, the signs that an intrusion may already have happened, Cisco recommends that users review the file named "access.log" and look for suspicious usernames. If the device is part of a distributed deployment, meaning the setup is spread across several machines that work together, it is essential to review the logs of every node and not just one of them. Cisco provided the following command to detect unexpected usernames: admin#show logging application ise-kong/access.log | include dummyuser. The presence of any entry in the output of that command likely points to malicious activity, the company said. If such activity is detected, users are advised to re-image the affected nodes, which means wiping them and installing a clean copy of the software, and to restore from a configuration backup if needed. Cisco also cautioned that a successful exploitation can give threat actors command execution with root privileges, the highest level of control over a system, and that because of that level of access the evidence of exploitation and the indicators of compromise may be removed or hidden by the attackers.

Cisco emphasized that there are no workarounds for this vulnerability. As a mitigation, which reduces exposure without fixing the underlying flaw, customers can use infrastructure access control lists (iACLs) to allow only the required management and control plane traffic that is destined to the affected device. In practice, an iACL is a filter that limits which machines are allowed to reach a piece of network equipment at all. Separately, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026. That catalog lists flaws confirmed as exploited in real attacks, and being added to it requires Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.

The disclosure comes only days after Cisco said a critical vulnerability affecting AsyncOS Software for Cisco Secure Email Gateway, tracked as CVE-2026-76461 with a CVSS score of 9.8, had come under active exploitation in the wild. Alongside CVE-2026-76460, Cisco rolled out fixes for a number of critical security vulnerabilities across its product range, some of which are hardening measures released as part of an ongoing review. Of the 77 new CVEs issued on Wednesday, 41 affect ISE and 28 affect the Secure Firewall portfolio. Among them: CVE-2026-20176 (CVSS 9.9), CVE-2026-20211 (CVSS 9.1) and CVE-2026-20307 (CVSS 9.1) are ISE flaws that let an authenticated remote attacker with valid administrative credentials run arbitrary commands on the operating system of a device. CVE-2026-76423 (CVSS 10.0) plus CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427 and CVE-2026-76428 cover ISE and ISE-PIC weaknesses that could allow authentication bypass on the REST API, remote code execution, SQL injection and XML External Entity injection attacks. CVE-2026-20282 (CVSS 9.1), CVE-2026-20283 and CVE-2026-20284 involve SQL injection, data modification and arbitrary command execution on ISE, while CVE-2026-20305 and CVE-2026-20306 (both CVSS 9.1) allow command injection and command execution as the root user for attackers holding valid administrative credentials. Cisco Nexus Dashboard is affected by CVE-2026-20322, CVE-2026-20325 (both CVSS 9.9), CVE-2026-20326 (CVSS 9.8), CVE-2026-20360, CVE-2026-20361 and CVE-2026-76409, which could lead to command injection, authentication or authorization bypass and information disclosure. Further ISE and ISE-PIC flaws are CVE-2026-20130 and CVE-2026-20192 (both CVSS 10.0), CVE-2026-20194 (CVSS 9.1), CVE-2026-20234 (CVSS 9.9), CVE-2026-20237 (CVSS 9.9) and CVE-2026-20287, with similar outcomes: command injection, authentication or authorization bypass and information disclosure.

The Secure Firewall range also received a large batch of fixes. CVE-2026-20329, CVE-2026-20330 (both CVSS 9.9), CVE-2026-20331 (CVSS 9.6), CVE-2026-20332 (CVSS 9.0) and CVE-2026-20333 through CVE-2026-20336 affect Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software and Cisco Secure Firewall Management Center (FMC) Software, grouped by weakness category and covering areas such as improper handling of exceptional conditions, improper access control, improper adherence to coding standards and improper control of a resource through its lifetime. CVE-2026-76412, CVE-2026-76413 and CVE-2026-76420 (CVSS 9.0) could let a remote attacker gain root access to FMC Software and forge or impersonate sessions. CVE-2026-20324 (CVSS 9.9) affects the sftunnel inter-device communication protocol of FMC Software and could let an authenticated remote attacker run arbitrary commands as root. CVE-2026-20340, CVE-2026-20341 (CVSS 9.1) and CVE-2026-20342 through CVE-2026-20344 concern FMC Software and could allow root access, the download of sensitive files, SQL injection or a denial-of-service condition. CVE-2026-20242 (CVSS 9.8