Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-76460: Cisco Identity Services Engine lets remote attacker bypass web admin
CVE-2026-76460 · published 26 days ago · actively exploited
Summary
The Cisco Identity Services Engine and its Passive Identity Connector contain a flaw where a remote user without credentials can use privileged functions to jump past the web management screen. This could let an attacker take control of the device and access sensitive network settings. Apply the latest security update from Cisco as soon as possible to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | identity services engine | All versions |
| cisco | cisco identity services engine software | 3.1.0 p8 |
| cisco | cisco ise passive identity connector | 3.4.0 |
| cisco | identity_services_engine |
3.1.0 3.2.0 3.3.0 3.4.0 3.5.0 cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:* |
| cisco | identity_services_engine_passive_identity_connector |
3.1.0 3.2.0 3.3.0 3.4.0 3.5.0 cpe:2.3:a:cisco:identity_services_engine_passive_identity_connector:3.1.0:-:*:*:*:*:*:* |
Original advisory text
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ci... Mitigation Vendor Advisory
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
10.0
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
14%
chance of attack within 30 days
Type
CWE-648Incorrect Use of Privileged APIs
Timeline
Published16 Sep 2026
Updated9 Oct 2026
First seen16 Sep 2026
Track software like this
Free during beta