Cisco ISE Flaw CVE-2026-76460 Allows Unauthenticated Web Bypass

En bref

• CVE-2026-76460 affects Cisco ISE and ISE-PIC deployments
• Exploitation requires no authentication and can be done remotely
• Success leads to web interface bypass and unauthorized device access
• Cisco recommends mitigations or discontinuing affected products
• Admins should assess internet exposure and apply patches

Cisco has disclosed a security weakness, tracked as CVE-2026-76460, that impacts its Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). An adversary operating remotely and without any credentials can exploit this issue to circumvent the web-based management interface. The consequence is that devices could be accessed by parties who should not have that privilege, undermining network access control.

Organizations running these Cisco products are the affected population, particularly those in government, education, and healthcare where ISE often enforces zero-trust segmentation. Because the flaw is remotely reachable and requires no login, any instance exposed to untrusted networks becomes a candidate for attack. The medium severity rating reflects that while exploitation is straightforward, the immediate blast radius may be limited to the web interface bypass unless chained with other flaws.

For K-12 districts and state agencies, Cisco ISE is frequently the gatekeeper for wired, wireless, and VPN admissions. A bypass of its web interface or unauthorized device access could let an intruder impersonate legitimate endpoints, move laterally, or disable enforcement policies. That risk is amplified if the management portal is reachable from the public internet, which should never be the case but sometimes occurs through misconfiguration.

Cisco's guidance centers on applying available mitigations. If no mitigation exists for a given deployment, the vendor advises discontinuing the product's use until a remedy is available. Administrators should also determine whether their ISE or ISE-PIC instances are internet-facing, then follow Cisco's patching guidance precisely. Until fixed, restrict access to the web UI through ACLs or VPN-only gateways, and monitor for anomalous authentication or device onboarding events.

What to watch: Cisco's advisory updates, any proof-of-concept code, and signs of scanning against ISE management ports. Prioritize this if your ISE is internet-exposed or supports remote sites.

À faire maintenant

1. Determine if any Cisco ISE or ISE-PIC management interface is reachable from the internet; if so, block it immediately with firewall rules or move it behind a VPN.
2. Apply Cisco's vendor-supplied mitigations or patches for CVE-2026-76460 as soon as they are published, following the official guidance.
3. If no fix or mitigation is available for your version, plan to discontinue use of the affected product until a remedy exists.
4. Restrict administrative access to the ISE web UI by IP allowlisting, jump hosts, or MFA to reduce the attack surface.
5. Review logs for unauthorized device access attempts, unexpected web interface sessions, or policy changes.
6. Subscribe to Cisco security advisories and re-evaluate exposure after each update.
7. For K-12 environments, coordinate with network and identity teams to validate that NAC enforcement remains intact.

Source originale

CISA Known Exploited Vulnerabilities