CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Published Sep 16, 2026
·Updated
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Other sources
Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
— CISA
Affected Software
90 affected components
Cisco Identity Services Engine (ISE)
Cisco Identity Services Engine
Cisco Identity Services Engine=3.1.0
Cisco Identity Services Engine=3.1.0-patch1
Cisco Identity Services Engine=3.1.0-patch10
Cisco Identity Services Engine=3.1.0-patch11
Cisco Identity Services Engine=3.1.0-patch2
Cisco Identity Services Engine=3.1.0-patch3
Cisco Identity Services Engine=3.1.0-patch4
Cisco Identity Services Engine=3.1.0-patch5
Cisco Identity Services Engine=3.1.0-patch6
Cisco Identity Services Engine=3.1.0-patch7
Cisco Identity Services Engine=3.1.0-patch8
Cisco Identity Services Engine=3.1.0-patch9
Cisco Identity Services Engine=3.2.0
Cisco Identity Services Engine=3.2.0-patch1
Cisco Identity Services Engine=3.2.0-patch10
Cisco Identity Services Engine=3.2.0-patch2
Cisco Identity Services Engine=3.2.0-patch3
Cisco Identity Services Engine=3.2.0-patch4
Cisco Identity Services Engine=3.2.0-patch5
Cisco Identity Services Engine=3.2.0-patch6
Cisco Identity Services Engine=3.2.0-patch7
Cisco Identity Services Engine=3.2.0-patch8
Cisco Identity Services Engine=3.2.0-patch9
Cisco Identity Services Engine=3.3.0
Cisco Identity Services Engine=3.3.0-patch1
Cisco Identity Services Engine=3.3.0-patch10
Cisco Identity Services Engine=3.3.0-patch11
Cisco Identity Services Engine=3.3.0-patch2
Cisco Identity Services Engine=3.3.0-patch3
Cisco Identity Services Engine=3.3.0-patch4
Cisco Identity Services Engine=3.3.0-patch5
Cisco Identity Services Engine=3.3.0-patch6
Cisco Identity Services Engine=3.3.0-patch7
Cisco Identity Services Engine=3.3.0-patch8
Cisco Identity Services Engine=3.3.0-patch9
Cisco Identity Services Engine=3.4.0
Cisco Identity Services Engine=3.4.0-patch1
Cisco Identity Services Engine=3.4.0-patch2
Cisco Identity Services Engine=3.4.0-patch3
Cisco Identity Services Engine=3.4.0-patch4
Cisco Identity Services Engine=3.4.0-patch5
Cisco Identity Services Engine=3.4.0-patch6
Cisco Identity Services Engine=3.5.0
Cisco Identity Services Engine=3.5.0-patch1
Cisco Identity Services Engine=3.5.0-patch2
Cisco Identity Services Engine=3.5.0-patch3
Cisco Identity Services Engine Passive Identity Connector=3.1.0
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch1
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch10
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch11
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch2
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch3
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch4
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch5
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch6
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch7
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch8
Cisco Identity Services Engine Passive Identity Connector=3.1.0-patch9
Cisco Identity Services Engine Passive Identity Connector=3.2.0
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch1
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch10
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch2
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch3
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch4
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch5
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch6
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch7
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch8
Cisco Identity Services Engine Passive Identity Connector=3.2.0-patch9
Cisco Identity Services Engine Passive Identity Connector=3.3.0
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch1
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch10
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch11
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch2
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch3
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch4
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch5
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch6
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch7
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch8
Cisco Identity Services Engine Passive Identity Connector=3.3.0-patch9
Cisco Identity Services Engine Passive Identity Connector=3.4.0
Cisco Identity Services Engine Passive Identity Connector=3.4.0-patch1
Cisco Identity Services Engine Passive Identity Connector=3.4.0-patch2
Cisco Identity Services Engine Passive Identity Connector=3.4.0-patch3
Cisco Identity Services Engine Passive Identity Connector=3.4.0-patch4
Cisco Identity Services Engine Passive Identity Connector=3.4.0-patch5
Cisco Identity Services Engine Passive Identity Connector=3.4.0-patch6
Event History
Sep 16, 2026
Kev Listed
via CISA·12:00 AM
CVE Published
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software
CVE Published
via MITRE·08:12 PM
Data Sourced
via MITRE·08:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction by sending a crafted request to an affected API endpoint. Successful exploitation bypasses the web-based management interface authentication.
2
What access could exploitation provide?
A successful exploit could give an unauthenticated remote attacker unauthorized access to the affected Cisco Identity Services Engine device. The provided severity vector indicates high impacts to confidentiality, integrity, and availability.