CVE-2026-76460 – Cisco Identity Services Engine Software
“When the system that decides who gets on the network can be walked past, every door behind it is already open.”
Cisco has released a security update for Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that fixes 14 vulnerabilities, 13 of them Critical. Attackers are actively exploiting CVE-2026-76460, an authentication bypass in an ISE API that lets an unauthenticated, remote attacker gain unauthorized access to the device. CVE-2026-76423 lets an unauthenticated attacker take administrative control through the exposed REST API and read or change ISE configuration and identity data. Several command injection and Java deserialization flaws let an authenticated attacker run arbitrary commands and elevate to root. CVE-2026-20284 enables SQL injection through the SXP REST API, and CVE-2026-20352 lets an unauthenticated attacker crash an ISE node with crafted RADIUS requests. In single-node deployments, a successful attack can take ISE offline and block endpoints that have not yet authenticated from reaching the network.
CVE-2026-20130, CVE-2026-20192, CVE-2026-76423, and CVE-2026-76460 each have a CVSS score of 10.0, Critical severity. CVE-2026-20234 and CVE-2026-20307 each have a CVSS score of 9.9, Critical severity. CVE-2026-20176, CVE-2026-20194, CVE-2026-20211, CVE-2026-20237, CVE-2026-20284, CVE-2026-20305, and CVE-2026-20306 each have a CVSS score of 9.1, Critical severity. CVE-2026-20352 has a CVSS score of 8.6, High severity.
Key Details
- Affected Product
- Cisco Identity Services Engine
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-648