CVE-2026-7646010.0CriticalCWE-648
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Cisco · Identity Services Engine
Exploited in the wild · in CISA KEV since 16 Sep
75.6%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 16 Sep · catalogue entry
Passed 42 days ago
DescriptionNVD
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage8 articles · 6 outlets
One row per outlet, in order of first report. First in our coverage: CISA, 16 Sep.
Quiet for 4 weekslast report 1 Oct8 articles6 outlets
- Wed 16 Sep, 19:03 UTC. CISA, first report. Attackers Exploit Cisco ISE Flaw to Bypass Management Interface. Cites a CVE in CISA KEV.
- Wed 16 Sep, 19:36 UTC. SecurityOnline, its first report on the story. Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access. Cites a CVE in CISA KEV.
- Thu 17 Sep, 06:36 UTC. SecurityWeek, its first report on the story. Cisco Patches Zero Day Letting Attackers Take Root Access in ISE. Cites a CVE in CISA KEV.
- Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
- Thu 17 Sep, 11:19 UTC. Infosecurity, its first report on the story. Attackers Exploit Critical Cisco ISE Flaw for Root Access. Cites a CVE in CISA KEV.
- Fri 18 Sep, 20:23 UTC. Dark Reading, its first report on the story. Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access. Cites a CVE in CISA KEV.
- Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access. Cites a CVE in CISA KEV.
- Thu 1 Oct, 14:52 UTC. Infosecurity. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 16 Sep 19:03 | CISA | Attackers Exploit Cisco ISE Flaw to Bypass Management Interface |
| 16 Sep 19:36 | SecurityOnline | Cisco ISE Flaw Exploited to Grant Unauthenticated Root Access |
| 17 Sep 06:36 | SecurityWeek | Cisco Patches Zero Day Letting Attackers Take Root Access in ISE |
| 17 Sep 10:42 | Security Affairs | CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws |
| 17 Sep 11:19 | Infosecurity | Attackers Exploit Critical Cisco ISE Flaw for Root Access |
| 18 Sep 20:23 | Dark Reading | Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access |
| 21 Sep 02:59 | SecurityOnline | Cisco Warns of Actively Exploited Flaws Enabling Root Access |
| 1 Oct 14:52 | Infosecurity | Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers |
- Cisco SD-WAN Zero Day Exposes Internet Facing Systems to AttackersInfosecurity · mentions it in passing
- CISA Flags Actively Exploited Cisco, Acronis and Pixel FlawsSecurity Affairs
- Attackers Exploit Cisco ISE Flaw to Bypass Management InterfaceCISA · official notice · first in our coverage
New articles also arrive in the RSS feed.