CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that lets a remote, unauthenticated attacker send one crafted request to an API endpoint, skip the login on the web management interface entirely, and land root-level command execution, regardless of how the appliance is configured. Cisco's PSIRT confirmed active exploitation, and CISA gave federal agencies just three days, until September 19, 2026, to patch it.

  • CVE-2026-76460 scores a perfect CVSS 3.1 base of 10.0 and bypasses ISE's web login entirely through one crafted request to an API endpoint.
  • Cisco's PSIRT says it is aware of active exploitation, found through a Technical Assistance Center support case, not by outside researchers.
  • CISA added it to the Known Exploited Vulnerabilities catalog on September 16, 2026 with a remediation deadline of September 19, three days, versus the usual three-week window.
  • It is Cisco's second KEV entry in three days: CVE-2026-76461, a Secure Email Gateway SQL injection, landed on September 14 with a September 17 deadline.

What is CVE-2026-76460 and how does it work?

The flaw sits in an API endpoint inside Cisco ISE and ISE-PIC. Per Cisco's advisory, cisco-sa-ISE-ABP-VNSW7Tn5, published September 16, 2026, the root cause is "insufficient authentication control on an API endpoint." Send it a crafted request, and the check that is supposed to gate the web-based management interface simply does not fire, "regardless of device configuration." That detail matters: there is no hardening toggle, no optional feature, no network posture that closes it off on its own. Cisco rates it CVSS 3.1 base 10.0, the ceiling of the scale, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning it is reachable over the network, needs no credentials, no user interaction, and only a low-complexity attack. Getting past the login screen does not land an attacker in a limited web console either. Successful exploitation grants root-level command execution on the appliance itself. CISA's KEV catalog files it under CWE-648, incorrect use of privileged APIs, naming it the "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability."

RelatedCisco Email Gateway Root Bug Exploited, CISA Gives 3 Days

How CVE-2026-76460 turns one request into root access An unauthenticated attacker sends a crafted request to an API endpoint on Cisco ISE. The authentication check on the web management interface never fires, and the attacker lands root-level command execution and control over network access policy and credentials. Internet Crafted APIrequest Authbypass Web mgmtinterface Rootshell Network policy+ credentials unauthenticated targets one endpoint CVE-2026-76460 full admin access command execution 802.1X / RADIUS control One crafted request skips every check between "unauthenticated" and "root." genztech.blog
Fig 1 CVE-2026-76460 chains a single crafted request to an API endpoint into a full authentication bypass on Cisco ISE's web management interface, then root-level command execution, "regardless of device configuration," per Cisco's advisory.

Why did CISA give Cisco only three days?

Standard KEV remediation windows run around three weeks. CISA cut that to three days for CVE-2026-76460: added to the catalog September 16, 2026, due September 19. That compression is itself a signal. Cisco's PSIRT statement is blunt: it is "aware of active exploitation," and the bug surfaced not from a researcher's disclosure but through a Cisco Technical Assistance Center support case, meaning a customer had already been hit before anyone had a fix. A three-day deadline is CISA telling federal agencies the exploit is already circulating and every extra day is a day it sits open on a network it can walk straight into. It is also the second time in three days Cisco has landed in KEV. CVE-2026-76461, a SQL injection in Cisco Secure Email Gateway, was added on September 14 with a September 17 deadline, and GenZTech covered that one on its own.

Cisco's two September KEV deadlines versus a typical remediation window CISA gave a three day remediation window for both CVE-2026-76461, Sept 14 to Sept 17, and CVE-2026-76460, Sept 16 to Sept 19, compared with a typical Known Exploited Vulnerabilities catalog deadline of around three weeks. 3 days 3 days 21 days CVE-2026-76461 CVE-2026-76460 Typical KEV entry Sept 14 to Sept 17 Sept 16 to Sept 19 roughly 3 weeks REMEDIATION WINDOW, IN DAYS genztech.blog
Fig 2 . KEV deadlines CISA's standard Known Exploited Vulnerabilities remediation window runs about three weeks. Both of Cisco's September entries got three days: CVE-2026-76461 on September 14 and CVE-2026-76460 on September 16.
  1. Sept 14, 2026CISA adds CVE-2026-76461 to KEV. Cisco Secure Email Gateway SQL injection, remediation due September 17.
  2. Sept 16, 2026Cisco publishes cisco-sa-ISE-ABP-VNSW7Tn5 and CISA adds CVE-2026-76460 to KEV. CVSS 10.0 ISE auth bypass, surfaced through a TAC support case, already under active exploitation.
  3. Sept 17, 2026Federal remediation deadline for CVE-2026-76461.
  4. Sept 19, 2026Federal remediation deadline for CVE-2026-76460. Three days from KEV addition to deadline, versus a typical three-week window.

Why is an ISE compromise worse than a typical appliance bug?

ISE is not just another box on the rack. It is the system that decides who gets on the network in the first place. It authenticates every device and user trying to connect, profiles what is connecting, checks security posture, and grants the right access level through 802.1X, RADIUS, or TACACS+ policy, then logs all of it. Compromise ISE and an attacker does not just own one appliance, they own the gatekeeper: they can mint their own access policies, wave devices past checks meant to stop them, and sit on a system holding credentials and a full device inventory for the entire estate. A root shell on ISE is a root shell on the thing everything else on the network is built to trust.

What should security teams do now?

There is no workaround for CVE-2026-76460. Cisco's only stopgap is an infrastructure access control list restricting who can reach the management interface or the affected API, and that is a mitigation, not a fix. The real fix is patching to the release that closes the hole:

RelatedCisco Secure FMC Flaw Lets Sandworm Skip the Login Screen

ISE / ISE-PIC releaseFixed patchPre-patch exposure
3.1Patch 12Auth bypass, regardless of configuration
3.2Patch 11Auth bypass, regardless of configuration
3.3Patch 12Auth bypass, regardless of configuration
3.4Patch 7Auth bypass, regardless of configuration
3.5Patch 4Auth bypass, regardless of configuration

Cisco's advisory also points to what to hunt for. Pull access.log entries for usernames that do not belong, and cross-check network and firewall logs for uploads or downloads from the appliance that nobody authorized. If either turns up, treat the box as already compromised, not merely vulnerable, and rotate the credentials and network policy tied to it, not just the software.

What it means for the market

Cisco (NASDAQ: CSCO) is the exposed name, not because CVE-2026-76460 alone moves a stock, but because of the pattern around it. Two actively exploited, KEV-listed vulnerabilities in three days, sitting inside a September hardening batch of more than 20 advisories spanning ISE, Secure Firewall Management Center, Nexus Dashboard, and ASA/FTD, including three more CVSS 10.0 bugs in ISE alone (CVE-2026-20130, CVE-2026-20192, CVE-2026-76423) that are patched but not confirmed exploited yet. Watch how enterprise and federal buyers respond over the next few quarters: repeated maximum-severity findings on identity infrastructure tend to surface in vendor risk reviews, not just headlines.

What to watch . 2026
  • Does the KEV list grow again. Three more CVSS 10.0 ISE bugs from the same batch, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, are patched but not yet confirmed exploited.
  • How fast agencies actually hit September 19. A three-day window is aggressive for change-controlled environments. Slippage here tests the deadline's teeth.
  • What the access.log hunt turns up. Cisco points defenders at suspicious usernames and unexpected uploads and downloads. Broader disclosure would show how far exploitation has spread.
  • Whether ISE keeps producing maximum-severity findings. Two Cisco KEV entries in three days, four CVSS 10.0 ISE bugs in one batch, is a harder pattern to manage than a single CVE.
Primary sources

Original analysis by GenZTech. Source: Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5.