Cisco ISE CVE-2026-76460: One Crafted Request Bypasses Network Access Control and Delivers Root

CVE-2026-76460 lives in ise-kong, the API gateway process that handles Cisco ISE's REST management interface. The vulnerability class is CWE-648 (Incorrect Use of Privileged APIs): a specific API endpoint accepts and processes requests without enforcing the authentication controls that should restrict access to authenticated administrators. An unauthenticated caller can invoke privileged management functions by sending a crafted HTTP request directly to that endpoint.

The attack path requires no credentials, no prior foothold, and no interaction from a legitimate user. An attacker with network access to the ISE management interface on TCP port 443 sends a crafted request to the vulnerable ise-kong endpoint. ISE processes the request as though it came from an authorized administrator. The attacker receives administrative access to the ISE management plane, from which they can read and modify access policies, alter RADIUS and TACACS+ configurations, create or delete network device entries, and execute operating system commands with root privileges on the underlying appliance.

Cisco's advisory (Cisco Bug ID: CSCww39530) notes that root-level access is achievable upon exploitation and explicitly warns that attackers at this privilege level can remove or hide all indicators of compromise from the ISE device itself. The mechanism for log deletion is straightforward on a Linux-based appliance: root access means unrestricted write and delete access to every file on disk, including the ise-kong/access.log files that would otherwise record the intrusion.

The Cisco-provided mitigation of applying infrastructure access control lists (iACLs) to restrict management plane traffic reduces the attack surface to known management hosts but does not eliminate the vulnerability. Any IP address permitted by an iACL can still exploit the flaw.

CVE-2026-76460 affects the complete Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) product line across all actively deployed versions from 3.0 through 3.5, regardless of device configuration, deployment mode, or network role. There are no architecture differences or configuration settings that prevent exploitation.

Cisco ISE deployments range from small single-node environments to large distributed clusters with primary administration nodes, policy service nodes, monitoring nodes, and passive identity connectors deployed across dozens of locations. In distributed ISE deployments, the vulnerability applies to every node in the cluster. An attacker who reaches any policy service node gains the same root-level access as one who reaches the primary administration node, and from the primary node, an attacker controls the access policy configuration for the entire enterprise network.

ISE Release 3.0 has reached End of Software Maintenance. Cisco will not issue a patch for 3.0 -- customers on this release must migrate to a supported version before they can remediate CVE-2026-76460. ISE Releases 3.1 and 3.2 are in Software Maintenance mode, meaning they receive only critical-severity fixes. The patches for those releases (3.1 Patch 12 and 3.2 Patch 11) address CVE-2026-76460 specifically but do not include the broader September 16 hardening bundle covering 41 ISE CVEs. Customers on 3.1 or 3.2 should plan migration to 3.3, 3.4, or 3.5 after applying the emergency patch.

A compromised Cisco ISE appliance is not a lateral movement stepping stone -- it is the network's policy engine. Whoever controls ISE controls who gets access to what, and can modify that control silently without triggering any authentication alert.

Root access on ISE exposes every piece of credential material stored on the appliance: RADIUS shared secrets for all network devices, TACACS+ shared secrets, administrator account password hashes, certificate private keys used for ISE's SSL termination, and any API keys stored in the ISE configuration. An attacker who extracts these secrets can authenticate to network switches, routers, and wireless controllers as a legitimate administrator, bypassing network device authentication entirely independent of the ISE policy engine itself.

The access policy modification threat is the most operationally damaging. An attacker with ISE administrative access can create permanent policy exceptions that grant attacker-controlled devices full network access at any segment boundary ISE controls, including access to production server VLANs, OT/ICS segments, and privileged management networks. These exceptions persist after the attacker's initial access session ends and survive an ISE appliance reboot unless the configuration is audited and the unauthorized entries are removed.

Cisco's advisory makes the forensic challenge explicit: attackers can delete ise-kong access logs and other artifacts that would document the compromise. This means defenders cannot rely solely on ISE's own audit trail to determine whether the device was accessed or what was changed.

Cisco has not published attacker infrastructure (C2 IP addresses, domains, or file hashes) for active CVE-2026-76460 exploitation. The attack requires no external infrastructure -- the exploit is a crafted HTTP request to the ISE API gateway, and post-exploitation activity takes place on the local ISE appliance. All available indicators are behavioral and log-based.

Run the following command on every ISE node in your deployment to check for suspicious usernames in the ise-kong API gateway log:

admin# show logging application ise-kong/access.log | include dummyuser

The "dummyuser" string is a Cisco-provided example placeholder. Substitute any suspicious or unexpected username pattern relevant to your environment. Any entry that appears in the output may indicate exploitation attempts. For distributed ISE deployments, Cisco requires running this check on every node individually, not just the primary administration node.

For extended log analysis, collect a support bundle with "include debug logs" selected, use shared key encryption, and examine the decrypted logs at ./ise/logs/apigateway/access.log.gz.

Because attackers with root access can purge ISE's own logs, also cross-check external sources for these behavioral indicators:

• Unexpected outbound connections from ISE appliance IPs to external hosts, particularly on ports other than standard update infrastructure channels
• Anomalous data transfer volumes originating from ISE management interfaces at unusual times
• Network device authentication events that do not correspond to known administrator actions in your change management system

If Cisco ISE compromise is confirmed or strongly suspected, re-image the affected nodes and restore from a known-good configuration backup. Do not attempt to sanitize a root-compromised ISE appliance in place.

These two rules target the initial REST API authentication bypass attempt and post-exploitation root process execution from the ise-kong gateway. Both carry experimental status; validate against your ISE webserver log format and Linux audit configuration before enabling automatic blocking.

The September 19 CISA deadline applies to US federal agencies, but every enterprise running Cisco ISE should treat it as the target. Cisco has provided no workaround that prevents exploitation -- iACLs reduce the attack surface by limiting which IPs can reach the management interface but do not fix the authentication bypass in ise-kong. The only remediation is upgrading to a fixed software release.

For ISE 3.0 deployments: Cisco will not patch this release. Migration to ISE 3.3, 3.4, or 3.5 is required before CVE-2026-76460 can be addressed. Contact Cisco TAC to initiate a migration plan.

For ISE 3.1, 3.2, 3.3, 3.4, and 3.5: Download and install the fixed patch from the Cisco Support and Downloads portal. Verify the installed build number matches the patched release using the ISE CLI after upgrade.

On September 16, Cisco also disclosed a parallel hardening advisory (cisco-sa-hardening-ise-XU5EwX5T) covering 41 ISE vulnerabilities discovered during an AI-assisted internal security review. ISE 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 address both the active CVE-2026-76460 and the full hardening bundle. ISE 3.1 Patch 12 and 3.2 Patch 11 address only the critical CVE -- those releases do not receive the full hardening package.

Cisco ISE is not an application server -- it is the network's trust anchor. Every 802.1X authentication decision, every RADIUS response, every zero-trust access policy enforcement that routes through Cisco infrastructure depends on ISE. Compromising ISE means the access control plane no longer belongs to the organization. The attacker decides who gets on the network.

Three factors make CVE-2026-76460 particularly severe beyond its CVSS score.

Pre-authentication reach means no credential theft or phishing is required before exploitation. If the ISE management interface is reachable from any network segment -- including segments where helpdesk staff or remote administrators connect from -- the attack surface is live at all times. iACLs help, but the typical enterprise management plane is accessible from more segments than most security teams realize.

The credential exposure consequence is not limited to the ISE appliance. RADIUS shared secrets and TACACS+ keys stored in ISE are the credential material for authenticating to every network device that uses ISE as its authentication server. An attacker who extracts these secrets can authenticate to switches, routers, and wireless controllers independent of the ISE policy engine, even after ISE is patched and re-imaged.

The AI-discovery angle is operationally important. Cisco's September 16 advisory noted that the internal security review that found these 41 ISE vulnerabilities used frontier AI models. That same AI-assisted discovery capability is now available to threat actors with resources to use it. The 41 CVEs are the finding from Cisco's own audit -- the unanswered question is how many of those same patterns exist in firmware and appliances from other vendors that have not yet run a comparable review.

See also: how a prior Cisco management plane compromise enabled ransomware deployment in our analysis of CVE-2026-20316: Cisco FMC Static Credential Exploit, and the authentication bypass pattern in CVE-2026-20182: Cisco SD-WAN Authentication Bypass.