Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

Attackers Exploit Cisco ISE Flaw to Bypass Management Interface

Part of the CVE-2026-76460 story · since 16 Sep

Quiet for 4 weekslast report 1 Oct8 articles6 outlets
16 Sep · CISA first3 Oct11 Oct19 OctNowThis article1st of 8
  • Wed 16 Sep, 19:03 UTC. CISA, first report. Attackers Exploit Cisco ISE Flaw to Bypass Management Interface. Cites a CVE in CISA KEV. This article, 1st of 8.
  • Wed 16 Sep, 19:36 UTC. SecurityOnline, its first report on the story. Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 06:36 UTC. SecurityWeek, its first report on the story. Cisco Patches Zero Day Letting Attackers Take Root Access in ISE. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 11:19 UTC. Infosecurity, its first report on the story. Attackers Exploit Critical Cisco ISE Flaw for Root Access. Cites a CVE in CISA KEV.
  • Fri 18 Sep, 20:23 UTC. Dark Reading, its first report on the story. Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 14:52 UTC. Infosecurity. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers. Cites a CVE in CISA KEV.

CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 September 2026. The vulnerability affects Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Cisco names it the Identity Services Engine Incorrect Use of Privileged APIs Vulnerability.

The flaw involves the incorrect use of privileged application programming interfaces (APIs). An unauthenticated, remote attacker could exploit it to bypass the web-based management interface and gain unauthorised access to an affected device. The available data does not provide a CVSS score or severity rating. Patch availability is currently unknown.

KEV inclusion confirms that attackers are actively exploiting this vulnerability. The available information does not confirm use in ransomware campaigns. CISA set 19 September 2026 as the remediation deadline for affected federal civilian executive branch (FCEB) agencies.

CISA requires organisations to apply mitigations in accordance with Cisco’s instructions, comply with BOD 26-04 guidance on prioritising security updates based on risk, and follow CISA’s Forensics Triage Requirements. Agencies should apply the relevant BOD 26-04 guidance for cloud services or discontinue using the product if mitigations are unavailable. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching requirements. FCEB agencies are directly subject to this requirement, but all organisations should review their exposure.

See the NVD entry and CISA KEV catalogue for full details.

How the story developed

All 8 articles
Quiet for 4 weekslast report 1 Oct8 articles6 outlets

8 articles from 6 outlets since 16 Sep. Quiet since 1 Oct. This was the first report.

Now16 Sep181920212 OctFirst reportCISA · 16 Sep, 19:03Picked up againafter 2 days quiet
  • Wed 16 Sep, 19:03 UTC. CISA, first report. Attackers Exploit Cisco ISE Flaw to Bypass Management Interface. Cites a CVE in CISA KEV. This article, 1st of 8.
  • Wed 16 Sep, 19:36 UTC. SecurityOnline, its first report on the story. Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 06:36 UTC. SecurityWeek, its first report on the story. Cisco Patches Zero Day Letting Attackers Take Root Access in ISE. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 11:19 UTC. Infosecurity, its first report on the story. Attackers Exploit Critical Cisco ISE Flaw for Root Access. Cites a CVE in CISA KEV.
  • Fri 18 Sep, 20:23 UTC. Dark Reading, its first report on the story. Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 14:52 UTC. Infosecurity. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Wed 16 SepDay 02
    1. Attackers Exploit Cisco ISE Flaw to Bypass Management Interface19:03 · CISA · official · First report · CISA alert · Known exploited CVE · This article, 1st of 8
    2. Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access19:36 · SecurityOnline · Known exploited CVE
  2. Thu 17 SepDay 13
    1. Cisco Patches Zero Day Letting Attackers Take Root Access in ISE06:36 · SecurityWeek · Known exploited CVE
    2. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Critical Cisco ISE Flaw for Root Access11:19 · Infosecurity · Known exploited CVE
  3. Fri 18 SepDay 21
    1. Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access20:23 · Dark Reading · Known exploited CVE

  4. Quiet for 2 days

    Mon 21 SepDay 51
    1. Cisco Warns of Actively Exploited Flaws Enabling Root Access02:59 · SecurityOnline · Picked up again · Known exploited CVE

  5. Quiet for 10 days

    Thu 1 OctDay 151
    1. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers14:52 · Infosecurity · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in