Detections
Analytics

CVE-2026-76460

critical

Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

References

https://www.infosecurity-magazine.com/news/critical-cisco-catalyst-sdwan/

https://www.bleepingcomputer.com/news/security/infratrust-report-warns-network-management-systems-under-attack/

https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues

https://www.theregister.com/security/2026/09/17/cisco-drops-another-exploited-zero-day-this-time-a-perfect-10/5297180

https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/

https://www.infosecurity-magazine.com/news/cisco-active-exploitation-critical/

https://www.helpnetsecurity.com/2026/09/17/cisco-ise-vulnerability-exploited-cve-2026-76460/

https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-zero-day-exploited-in-attacks/

https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html

https://securityaffairs.com/199239/security/u-s-cisa-adds-acronis-backup-cisco-ise-and-google-pixel-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://cyberscoop.com/cisco-ise-zero-day-cve-2026-76460/

https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81122

Details

Source: Mitre, NVD

Published: 2026-09-16

Updated: 2026-10-07

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.14026

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest