Auth bypass wey get maximum severity hit di identity authority itself — Cisco ISE CVE-2026-76460 and di pattern wey dey repeat of boundary-appliance root compromise
Cisco ISE / ISE-PIC authentication bypass CVE-2026-76460 (CVSS 10.0) dey under active exploitation. CISA add am to di KEV catalog for 16 September with federal remediation deadline of 19 September; workaround no dey and iACLs na only mitigation. We dey look di boundary-appliance root-compromise pattern — wey dey run parallel with di Secure Email Gateway zero-day (CVE-2026-76461) wey dem disclose 14 September — and wetin e mean when logs of compromised appliance itself stop to be primary source.
Dis article na machine translation.
For 16 September 2026, Cisco disclose CVE-2026-76460, authentication-bypass vulnerability for Cisco Identity Services Engine (ISE) and di ISE Passive Identity Connector, wey carry di maximum CVSS 3.1 score of 10.0. Di root cause na insufficient authentication control on API endpoint: unauthenticated remote attacker wey send crafted request fit bypass di web management interface authentication and gain unauthorized access to di device. Cisco talk say dem sabi say active exploitation dey happen, but dem never publish who dey behind am or wetin intruders do afterward. All releases from 3.1 through 3.5 dey affected no matter di configuration; fixes ship as 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. Version 3.0, wey don already pass End of Software Maintenance, no get patch path — migration na di only route (Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5).
Cisco talk plain say workaround no dey wey address dis vulnerability, and dem offer infrastructure ACLs (iACLs) as temporary mitigation to restrict management- and control-plane traffic to required sources only — distinction wey matter, since iACLs dey reduce exposure without to fix di vulnerable endpoint. On detection, Cisco warn say successful exploitation fit yield root-level command execution, meaning evidence and IoCs fit dey removed or hidden by di attacker. Dem recommend to review access.log on every node of distributed deployment — `show logging application ise-kong/access.log | include dummyuser` to surface unexpected usernames — and to re-image nodes and restore from configuration backup if malicious entries appear. CISA add di CVE to im KEV catalog for 16 September, and set 19 September remediation deadline for federal agencies (according to The Hacker News and CISA).
Analysis (wey we separate from facts): dis na di second «public management plane to root» incident wey Cisco dey run parallel dis week. Where di Secure Email Gateway zero-day CVE-2026-76461 (disclosed 14 September) reach root through SQL injection for parsing code, CVE-2026-76460 arrive through auth-bypassed management API — different doors, same destination: total compromise of boundary appliance. ISE dey sit for di center of enterprise network-access decisions, dey aggregate identity, policy, and access-control data; when e fall to root, di whole trust chain behind am dey captured with am. According to The CyberSec Guru tally, Cisco September batch span 77 CVEs (41 wey touch ISE, 28 Secure Firewall), including separate CVSS 10.0 ISE REST API auth bypass, CVE-2026-76423. Batch wey mix «actively exploited» and «no evidence of exploitation» items na triage problem by itself.
Wetin e mean for defense: (1) If you dey operate ISE/ISE-PIC, to apply di matching patch na dis week highest-priority change; installs of 3.0 wey still remain na separate technical debt with no fix path. (2) iACL restriction of di management plane worth to do immediately, but record am as mitigation, no be remediation. (3) No let detection depend only on di appliance own logs — pair di `dummyuser` review with external firewall and NetFlow history for traffic to and from ISE. (4) If root compromise dey on di table, to verify di integrity of di appliance configuration and policy against backups become mandatory recovery step. Facts here draw on Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5), di CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), The Hacker News (https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html), and The CyberSec Guru for batch-scale figures (https://thecybersecguru.com/news/cisco-ise-cve-2026-76460-authentication-bypass). Analysis dey kept separate from reporting.