CISA KEV Update Flags Cisco ISE API Auth Bypass as Exploited

Key points

• CISA added CVE-2026-76460, a Cisco ISE API authentication bypass, to its Known Exploited Vulnerabilities catalog.
• A KEV listing generally indicates observed exploitation, raising urgency beyond a routine vulnerability notice.
• K-12 districts using Cisco ISE for network access control should patch or mitigate exposed systems quickly.
• The same catalog update also references Acronis Backup and Google Pixel flaws; verify those details directly in CISA's catalog.
• Review ISE API exposure and logs for unauthorized access attempts or unexpected configuration changes.

CISA has added CVE-2026-76460 to its Known Exploited Vulnerabilities catalog. The flaw is described as an authentication bypass in an API within Cisco Identity Services Engine, or ISE. That KEV designation matters because it generally means there is evidence of active exploitation, not just a theoretical weakness. The same catalog update also references flaws in Acronis Backup and Google Pixel products, though the provided details focus on the Cisco ISE issue. Districts should verify the full list directly against CISA's catalog.

Cisco ISE is commonly used in school networks to enforce access control, authenticate users and devices, and apply segmentation policies for wired, wireless, and guest access. If an attacker can bypass authentication in an ISE API, the integrity of those policy decisions may be at risk. Depending on deployment and API exposure, consequences could include unauthorized changes, data exposure, or weakened network segmentation. The exact scope should be confirmed against Cisco's advisory and CISA's KEV entry.

For K-12 IT teams, the practical concern is not only whether ISE is installed, but whether its API is reachable from untrusted networks. Management interfaces and APIs should never be broadly internet-facing. A KEV listing should drive immediate inventory and patching, plus compensating controls if a patch cannot be applied right away.

Watch for vendor guidance on fixed versions and mitigations, CISA's remediation due date, and any signs of exploitation in ISE logs, such as unexpected API calls or authentication anomalies. Also review the Acronis and Google Pixel entries separately if those products are in use.

What to do now

1. Inventory all Cisco ISE instances, including versions, deployment mode, and whether the API or management interface is reachable from untrusted networks.
2. Check Cisco's advisory for CVE-2026-76460 and apply the recommended patch or mitigation immediately; if patching is delayed, implement temporary compensating controls.
3. Restrict ISE API and administrative access to trusted management VLANs or VPN-only paths, and remove any direct internet exposure.
4. Review ISE and network logs for suspicious API calls, authentication anomalies, or unexpected configuration changes, and escalate suspected incidents.
5. Enforce least privilege and multifactor authentication for ISE administrators, and rotate credentials if compromise is suspected.
6. Verify CISA KEV entries for Acronis Backup and Google Pixel, then patch or mitigate any affected systems in the environment.
7. Track CISA and vendor advisories for updates, including remediation deadlines, and document completion for audit purposes.

CVE references

• CVE-2026-76460

Original source

Security Affairs