Cisco ISE CVE-2026-76460: Auth Bypass Response Guide

ISE is the policy brain of most enterprise network access control (NAC) and 802.1X deployments — it decides which devices and users get onto the network, at what privilege, and enforces that decision at every switch and wireless controller that queries it via RADIUS/TACACS+. Root access to an ISE node doesn't just expose the appliance itself: an attacker can rewrite access policy to admit rogue devices, harvest the credentials and certificates ISE uses to authenticate against Active Directory and network infrastructure, and use root-level command execution to erase the audit trail that would otherwise reveal the intrusion.

This is the second Cisco management-plane CVSS 10.0/9.8-class auth-bypass KEV entry in the space of a week, following CVE-2026-20079 (Cisco Firewall Management Center, added to KEV Sep 9) and CVE-2026-76461 (Cisco Secure Email Gateway, added Sep 14, covered in our companion response guide). Organizations running a Cisco-heavy stack should treat this as a pattern requiring a full identity/management-plane patch sweep, not an isolated one-off.

Exposure is determined by version and network reachability of the management API — no prior account or access is needed to reach the trigger.

• •Inventory every ISE and ISE-PIC node (all deployment forms — appliance, virtual) and confirm the running patch level against Cisco's advisory: fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 (3.0 is end-of-support and unpatched — plan a version upgrade, not just a patch)
• •Confirm which ISE nodes' admin/API interfaces are reachable beyond a locked-down management network — internet- or broad-internal-network-facing nodes are the priority
• •Cisco states no configuration workaround exists; infrastructure access control lists (iACLs) restricting management and control-plane traffic to authorized administrative hosts are a mitigation, not a fix

With active exploitation confirmed and no workaround beyond network restriction, patching is not optional change-control work — treat it as an incident-driven emergency change.

• •Patch to the fixed release for your train immediately: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 — nodes still on 3.0 need a version upgrade first, as 3.0 receives no fix
• •Until patched, restrict all management/API-plane access to ISE nodes using iACLs limited to known administrative source IPs — this is Cisco's only stated mitigation
• •Review ISE administrative and API access logs for authentication events that bypass normal login flow, unexpected privileged API calls, or new admin accounts/policy changes you did not make
• •Given root-level command execution is in scope, assume evidence-tampering capability — cross-check ISE logs against upstream syslog/SIEM forwarding rather than trusting the node's own local logs alone if compromise is suspected
• •Rotate RADIUS/TACACS+ shared secrets and any AD service-account credentials configured on a node showing signs of compromise, since ISE holds the keys to your network access control trust chain
• •Treat any node with signs of compromise as a full incident under your IR plan — see our ransomware IR playbook for the same NIST SP 800-61 containment-and-recovery structure

The September 19, 2026 federal deadline binds only U.S. federal civilian agencies under BOD 22-01, and it has already passed as of this guide — that is not a reason to deprioritize the patch, since CISA's KEV listing reflects confirmed active exploitation, not a compliance formality with an expiry. An unpatched, publicly known, actively exploited CVSS 10.0 auth bypass on network access control infrastructure is exactly the profile CERT-In and sector regulators (BFSI, healthcare) treat as a 'known and preventable' gap in any subsequent incident review under India's reporting obligations, independent of which country's federal deadline applies.