Cisco ISE CVE-2026-76460 – Actively Exploited Authentication Bypass to Root

Threat Overview

Cisco published CVE-2026-76460 on September 16, 2026. The CVSS 10.0 flaw is an authentication-control failure in a Cisco Identity Services Engine API. An unauthenticated remote attacker can send a crafted request to the affected API endpoint, bypass the web management interface, and gain unauthorized access. Cisco states that successful exploitation may lead to command execution with root privileges. Cisco PSIRT confirms active exploitation. Cisco published dummyuser in ise-kong/access.log as a non-exhaustive detection pivot.

References

• Cisco Security Advisory, September 16, 2026: https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-ISE-ABP-VNSW7Tn5.html
• CISA Known Exploited Vulnerabilities Catalog, September 16, 2026.

Impacted Systems

Cisco Identity Services Engine and Cisco ISE Passive Identity Connector are affected regardless of configuration. Fixed releases are ISE/ISE-PIC 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4. ISE 3.0 is end of software maintenance and should be migrated. Cisco lists no workaround and recommends infrastructure ACLs restricting management and control-plane traffic to required sources.

Why this matters

ISE is an identity and network-access control system. Root compromise can undermine a trusted authentication and policy-enforcement component and expose credentials, configuration, and downstream access-control relationships.

Exploitation Status

Confirmed active exploitation. Cisco PSIRT is aware of exploitation and CISA added CVE-2026-76460 to KEV. No attacker IP list, payload hash, or complete exploit request path has been published.

What this hunt looks for

The hunt prioritizes Cisco’s published username indicator, ISE API-gateway authentication anomalies, root and shell behavior, administrative changes, unexpected transfers, new management-plane sources, and unusual outbound traffic.

Required logs

Cisco ISE application/Syslog telemetry and independent firewall or network telemetry ingested into Microsoft Sentinel. Root compromise can allow local evidence removal, so independent network telemetry is particularly valuable.

First Pass – Cisco Published dummyuser IOC

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has "dummyuser"
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

ISE API Gateway Suspicious Activity

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("ise-kong","apigateway","access.log")
| where SyslogMessage has_any ("dummyuser","unauthorized","authentication","login")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

ISE Root and Shell Activity

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("ise","ISE","ise-kong","apigateway")
| where SyslogMessage has_any ("uid=0","root","/bin/bash","/bin/sh","curl ","wget ","chmod +x")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

ISE Administrative Changes

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("ISE","ise","administrator","admin")
| where SyslogMessage has_any ("created","added","changed","modified","configured","role","password")
| project TimeGenerated,Computer,HostName,ProcessName,SeverityLevel,SyslogMessage
| order by TimeGenerated desc

New Management Plane Sources

let Known=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| where DestinationPort in (443,22)
| summarize by SourceIP,DestinationIP,DestinationPort;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| where DestinationPort in (443,22)
| join kind=leftanti Known on SourceIP,DestinationIP,DestinationPort
| project TimeGenerated,SourceIP,DestinationIP,DestinationPort,Protocol,DeviceAction,Message
| order by TimeGenerated desc

Detection Notes

dummyuser is the highest-confidence vendor-provided pivot but is non-exhaustive. A root attacker can delete local evidence, so absence from ISE logs does not clear an appliance. Application logs may not be forwarded to Sentinel by default. Independent firewall and network telemetry should be used to corroborate suspicious activity.