A Maximum-Severity Auth Bypass Hits the Identity Authority Itself — Cisco ISE CVE-2026-76460 and the Recurring Pattern of Boundary-Appliance Root Compromise

On September 16, 2026, Cisco disclosed CVE-2026-76460, an authentication-bypass vulnerability in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector, carrying the maximum CVSS 3.1 score of 10.0. The root cause is insufficient authentication control on an API endpoint: an unauthenticated remote attacker sending a crafted request can bypass the web management interface's authentication and gain unauthorized access to the device. Cisco says it is 'aware of active exploitation' but has not published who is behind it or what intruders did afterward. All releases from 3.1 through 3.5 are affected regardless of configuration; fixes ship as 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Version 3.0, already past End of Software Maintenance, has no patch path — migration is the only route (Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5).

Cisco states plainly that 'there are no workarounds that address this vulnerability,' offering infrastructure ACLs (iACLs) as a temporary mitigation to restrict management- and control-plane traffic to required sources only — a distinction that matters, since iACLs reduce exposure without fixing the vulnerable endpoint. On detection, Cisco warns that successful exploitation may yield root-level command execution, meaning evidence and IoCs can be removed or hidden by the attacker. It recommends reviewing access.log on every node of a distributed deployment — `show logging application ise-kong/access.log | include dummyuser` to surface unexpected usernames — and re-imaging nodes and restoring from configuration backup if malicious entries appear. CISA added the CVE to its KEV catalog on September 16, setting a September 19 remediation deadline for federal agencies (per The Hacker News and CISA).

Analysis (separated from facts): this is the second 'public management plane to root' incident Cisco has run in parallel this week. Where the Secure Email Gateway zero-day CVE-2026-76461 (disclosed September 14) reaches root through SQL injection in parsing code, CVE-2026-76460 arrives through an auth-bypassed management API — different doors, same destination: total compromise of a boundary appliance. ISE sits at the center of enterprise network-access decisions, aggregating identity, policy, and access-control data; when it falls to root, the entire trust chain behind it is captured along with it. Per The CyberSec Guru's tally, Cisco's September batch spans 77 CVEs (41 touching ISE, 28 Secure Firewall), including a separate CVSS 10.0 ISE REST API auth bypass, CVE-2026-76423. A batch mixing 'actively exploited' and 'no evidence of exploitation' items is itself a triage problem.

Defensive implications: (1) If you operate ISE/ISE-PIC, applying the matching patch is this week's highest-priority change; lingering 3.0 installs are separate technical debt with no fix path. (2) iACL restriction of the management plane is worth doing immediately, but record it as mitigation, not remediation. (3) Do not let detection depend solely on the appliance's own logs — pair the `dummyuser` review with external firewall and NetFlow history for traffic to and from ISE. (4) If root compromise is on the table, verifying the integrity of the appliance's configuration and policy against backups becomes a mandatory recovery step. Facts here draw on Cisco's advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5), the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), The Hacker News (https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html), and The CyberSec Guru for batch-scale figures (https://thecybersecguru.com/news/cisco-ise-cve-2026-76460-authentication-bypass). Analysis is kept separate from reporting.