“An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface,” Cisco wrote in its update dated September 16.
CVE-2026-76460: a maximum-severity API vulnerability under active exploitation
Cisco has warned customers that CVE-2026-76460 — a flaw the company attributes to insufficient control on an API endpoint — is being actively exploited. The vulnerability carries a maximum CVSS score of 10.0 and, according to Cisco, allows an attacker to bypass the web-based management interface by sending a crafted request to the affected API endpoint, enabling unauthorized access to the device.
Cisco ISE and ISE-PIC: which devices are at risk
The vulnerability affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE‑PIC), regardless of device configuration. Cisco describes ISE as “a centralized security policy management platform that controls network access across wired, wireless and VPN connections,” making the affected products integral to network access control in environments that deploy them.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCisco’s fixes, short-term mitigations, and detection guidance
Cisco has released software updates to address CVE-2026-76460 and has urged customers to upgrade to prevent exploitation. The company states there are no workarounds that fully address the vulnerability. As an interim control prior to applying the software update, Cisco recommends using infrastructure access control lists (iACLs) to “allow only required management and control plane traffic that is destined to the affected device” to prevent remote exploitation.
For detection, Cisco told customers to review the product’s access.log for suspicious usernames and provided an example of how such entries may appear. “The presence of any entry in the output may indicate malicious activity. This should be done on every node in the deployment. If malicious activity is suspected, it is strongly recommended to re-image the affected nodes and restore from configuration backup if needed,” Cisco said.
The company also warned that a successful exploit could grant attackers command execution with root privilege, enabling them to remove or hide evidence of exploitation and indicators of compromise. For that reason Cisco “strongly recommends that administrators cross-check the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity,” including “unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.”
CISA inclusion in the KEV catalog and federal consequences
Following Cisco’s public disclosure, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog. That listing requires Federal Civilian Executive Branch (FCEB) agencies to prioritize applying a patch for the vulnerability, elevating remediation timelines for affected federal systems.
How technologists, FCEB agencies, and enterprise administrators are responding
- Technologists and security teams: apply Cisco’s software updates as the primary remediation, implement iACLs to restrict management and control plane traffic until patches are installed, and inspect access.log entries for the suspicious username patterns Cisco highlighted.
- FCEB agencies and regulators: treat the KEV listing as a directive to prioritize patching and coordinate remediation across deployments that use Cisco ISE and ISE‑PIC.
- Enterprise administrators and procurement leaders: cross-check device network and firewall logs for unexpected uploads to external IPs or downloads from malicious IPs, and prepare to re-image affected nodes and restore configurations if signs of compromise are found.
Cisco’s advisory sits alongside a broader batch of company notices that include fixes for other issues; for CVE-2026-76460, however, the combination of active exploitation, a 10.0 CVSS rating, and the potential for root‑level command execution makes immediate patching and log review the central, concrete steps available to defenders. For organizations that run ISE or ISE‑PIC, the choices are simple and urgent: deploy Cisco’s updates, use iACLs to limit exposure in the short term, and hunt for the indicators Cisco has published — including suspicious access.log entries and unexpected external uploads — before adversaries can cover their tracks.
