Cisco ISE Authentication Bypass Under Active Exploitation at CVSS 10.0

En bref

• Cisco disclosed CVE-2026-76460, a CVSS 10.0 flaw in Identity Services Engine.
• An unauthenticated remote attacker can bypass authentication through an API endpoint.
• Cisco says the vulnerability is being exploited in active attacks.
• ISE often supports network access control, so K-12 environments using it should treat this as urgent.
• Affected versions, patches, and indicators should be confirmed through Cisco's official advisory.

Cisco has disclosed CVE-2026-76460, a maximum-severity vulnerability in Identity Services Engine that carries a CVSS score of 10.0. According to the available details, the issue stems from weak authentication enforcement on an API endpoint and can let an unauthenticated attacker bypass authentication remotely. Cisco has also stated that the flaw is being exploited in active attacks, which raises the urgency for any organization running ISE.

ISE is commonly used to enforce identity-based access to wired and wireless networks, apply device posture checks, manage guest access, and support zero-trust-style segmentation. In a K-12 environment, those functions may sit between students, staff, guest devices, and internal systems. A successful bypass could allow an attacker to interact with protected API functions or gain trusted access to network policy controls, depending on how the deployment is configured and exposed. The source excerpt does not specify affected versions, exploitation targets, or indicators, so those details should be confirmed through Cisco's advisory.

Because the flaw is unauthenticated and remote, exposure is the key risk factor. Internet-facing management or API interfaces increase the attack surface, and active exploitation means defenders may have less time to test and patch. Even where ISE is not directly internet-facing, an attacker with a foothold elsewhere could attempt to reach the API from inside the network.

For New Brunswick K-12 IT teams, the immediate priority is to inventory ISE deployments, confirm whether the vulnerable API is reachable, and check Cisco's guidance for fixed releases and interim mitigations. Restrict management access, review authentication logs, and watch for unexpected API activity, policy changes, or new trusted sessions. Monitor Cisco's advisory and any updates from regional cybersecurity partners for revised severity, patches, and indicators of compromise.

À faire maintenant

1. Confirm whether your organization operates Cisco ISE and document versions, deployment roles, and whether the API or management interface is reachable from untrusted networks.
2. Open Cisco's official advisory for CVE-2026-76460 and verify affected versions, fixed releases, and supported workarounds before making changes.
3. Immediately block internet exposure of ISE management and API interfaces; limit access to trusted admin networks, VPN, or jump hosts with MFA.
4. Apply Cisco-recommended patches or mitigations as soon as possible under emergency change procedures; if patching is delayed, isolate or tightly restrict the affected service.
5. Review ISE authentication, API, and policy-change logs for unusual activity, especially unauthenticated requests, unexpected admin sessions, or configuration changes.
6. Confirm backups and recovery plans for ISE, and preserve logs for potential incident response if exploitation is suspected.
7. Brief network, security, and identity teams on the active exploitation status and set up monitoring for Cisco advisory updates and vendor indicators.

Références CVE

• CVE-2026-76460

Source originale

The Hacker News