by Kastro
Paper/Archive/CVE-2026-76460

CVE-2026-76460

Cisco Cisco Identity Services Engine Software — Cisco Identity Services Engine Authentication Bypass Vulnerability

KEV · due 19 SepEPSS 76%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Affected

ProductAffectedFixed inSource
Cisco Identity Services Engine Software3.1.0 p8–CNA
Cisco Identity Services Engine Software3.1.0 p9–CNA
Cisco Identity Services Engine Software3.3 Patch 2–CNA
Cisco Identity Services Engine Software3.3 Patch 1–CNA
Cisco Identity Services Engine Software3.3 Patch 3–CNA
Cisco Identity Services Engine Software3.4.0–CNA
Cisco Identity Services Engine Software3.2.0 p7–CNA
Cisco Identity Services Engine Software3.3 Patch 4–CNA
Cisco Identity Services Engine Software3.4 Patch 1–CNA
Cisco Identity Services Engine Software3.1.0 p10–CNA
Cisco Identity Services Engine Software3.3 Patch 5–CNA
Cisco Identity Services Engine Software3.3 Patch 6–CNA

Scores by source

cisco (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460kevcisa.gov/known-exploited-vulnerabilities-catalog