Incorrect use of privileged APIs in Cisco Identity Services Engine (ISE) - CVE-2026-76460
Published: September 16, 2026 / Updated: September 16, 2026
Vulnerability identifier: #VU150233
CSH Severity: Critical
CVSS v4: 10 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2026-76460
CWE-ID: CWE-648
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to missing authentication checks on certain API endpoints. A remote non-authenticated attacker can send specially crafted HTTP requests to the affected API endpoint and gain full access to the system. The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Cisco Identity Services Engine (ISE)
How to mitigate CVE-2026-76460
Install updates from vendor's website.
Cisco Identity Services Engine (ISE) - addressed in versions 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4