SB2026091659 - Authentication bypass in Cisco Identity Services Engine

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091659

SB2026091659 - Authentication bypass in Cisco Identity Services Engine

Published: September 16, 2026 Updated: September 16, 2026

Security Bulletin ID SB2026091659
CSH Severity
Critical
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect use of privileged APIs (CVE-ID: CVE-2026-76460) Exploited

CWE-ID: CWE-648 - Incorrect Use of Privileged APIs

CVSSv4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authentication checks on certain API endpoints. A remote non-authenticated attacker can send specially crafted HTTP requests to the affected API endpoint and gain full access to the system. The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.

Note, the vulnerability is being actively exploited in the wild. 


Remediation

Install update from vendor's website.

References