← Back

CVE-2026-76447

nvd nist
Published: Sep 16, 2026Modified: Sep 28, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 3.9 / Impact: 1.4
Source: psirt@cisco.com (Secondary)

Description

A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a function of the OCSP responder. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause the OCSP responder to reload certificate and key material on demand.

Affected (42)

Cisco
2 products
Identity Services Engine Passive Identity Connector
Identity Services Engine
Configuration A
19 vulnerable
Vulnerable SoftwareAffected Versions
Cisco
Identity Services Engine Passive Identity Connector
version < 3.3.0
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch10
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch11
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch1
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch2
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch3
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch4
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch5
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch6
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch7
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch8
Identity Services Engine Passive Identity Connector
Version 3.3.0 patch9
Identity Services Engine Passive Identity Connector
Version 3.4.0
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch1
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch2
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch3
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch4
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch5
Identity Services Engine Passive Identity Connector
Version 3.4.0 patch6
Configuration B
23 vulnerable
Vulnerable SoftwareAffected Versions
Cisco
Identity Services Engine
version < 3.3.0
Identity Services Engine
Version 3.3.0 patch10
Identity Services Engine
Version 3.3.0 patch11
Identity Services Engine
Version 3.3.0 patch1
Identity Services Engine
Version 3.3.0 patch2
Identity Services Engine
Version 3.3.0 patch3
Identity Services Engine
Version 3.3.0 patch4
Identity Services Engine
Version 3.3.0 patch5
Identity Services Engine
Version 3.3.0 patch6
Identity Services Engine
Version 3.3.0 patch7
Identity Services Engine
Version 3.3.0 patch8
Identity Services Engine
Version 3.3.0 patch9
Identity Services Engine
Version 3.4.0
Identity Services Engine
Version 3.4.0 patch1
Identity Services Engine
Version 3.4.0 patch2
Identity Services Engine
Version 3.4.0 patch3
Identity Services Engine
Version 3.4.0 patch4
Identity Services Engine
Version 3.4.0 patch5
Identity Services Engine
Version 3.4.0 patch6
Identity Services Engine
Version 3.5.0
Identity Services Engine
Version 3.5.0 patch1
Identity Services Engine
Version 3.5.0 patch2
Identity Services Engine
Version 3.5.0 patch3

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

Source: psirt@cisco.com
Vendor Advisory

Timeline

No history available yet.