Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Cisco ISE API allows remote attacker admin access

CVE-2026-76423 · published 26 days ago
Summary

The REST API used by Cisco Identity Services Engine and its Passive Identity Connector does not properly check who is calling it. An attacker on the network could send a specially crafted request and gain full administrative control, allowing them to view and change configuration and identity data. Apply the vendor's security update or restrict access to the API port to trusted hosts immediately.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cisco cisco identity services engine software 3.1.0
cisco cisco ise passive identity connector 3.2.0
Original advisory text
Cisco ISE API Authentication Bypass Vulnerability
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device.

This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exploit could allow the attacker to read and modify ISE configuration and identity data with administrative privileges.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published16 Sep 2026
Updated11 Oct 2026
First seen16 Sep 2026
Sources
CVE-2026-76423 · NVD
CVE-2026-76423 · MITRE
Track software like this
Free during beta