CVE-2026-76460
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Key facts
- CVSS score
- 10.0 (v3.1)
- Severity
- CRITICAL
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
- CWE-648
- EPSS score
- 14.0% (97th percentile)
- In CISA KEV
- Yes, added September 16, 2026
- In EU EUVD
- Yes (EUVD-2026-81122)
- Published
- September 16, 2026
- NVD last modified
- October 7, 2026
- Status
- Analyzed
CISA Known Exploited Vulnerability
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Added to the KEV catalog on September 16, 2026; federal remediation due September 19, 2026.
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2026-81122 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 7, 2026.
View on the EU Vulnerability DatabaseAffected products
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine
- cisco / identity services engine passive identity connector
- cisco / identity services engine passive identity connector
- cisco / identity services engine passive identity connector
- cisco / identity services engine passive identity connector
and 38 more…
Certified products that may be affected
1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.
- Cisco Identity Services Engine (ISE) V3.3 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11517-2025 - active
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460(US Government Resource)
Last updated October 9, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain