CVE-2026-76460

Published: Sep 16, 2026Modified: Oct 7, 2026CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: psirt@cisco.com (Secondary)

Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Affected (88)

Products: Cisco: Identity Services Engine, Identity Services Engine Passive Identity Connector

Cisco

2 products

Identity Services Engine

Identity Services Engine Passive Identity Connector

Configuration A

46 vulnerable

Vulnerable Software	Affected Versions
Cisco Identity Services Engine	Version 3.1.0
Cisco Identity Services Engine	Version 3.1.0 patch10
Cisco Identity Services Engine	Version 3.1.0 patch11
Cisco Identity Services Engine	Version 3.1.0 patch1
Cisco Identity Services Engine	Version 3.1.0 patch2
Cisco Identity Services Engine	Version 3.1.0 patch3
Cisco Identity Services Engine	Version 3.1.0 patch4
Cisco Identity Services Engine	Version 3.1.0 patch5
Cisco Identity Services Engine	Version 3.1.0 patch6
Cisco Identity Services Engine	Version 3.1.0 patch7
Cisco Identity Services Engine	Version 3.1.0 patch8
Cisco Identity Services Engine	Version 3.1.0 patch9
Cisco Identity Services Engine	Version 3.2.0
Cisco Identity Services Engine	Version 3.2.0 patch10
Cisco Identity Services Engine	Version 3.2.0 patch1
Cisco Identity Services Engine	Version 3.2.0 patch2
Cisco Identity Services Engine	Version 3.2.0 patch3
Cisco Identity Services Engine	Version 3.2.0 patch4
Cisco Identity Services Engine	Version 3.2.0 patch5
Cisco Identity Services Engine	Version 3.2.0 patch6
Cisco Identity Services Engine	Version 3.2.0 patch7
Cisco Identity Services Engine	Version 3.2.0 patch8
Cisco Identity Services Engine	Version 3.2.0 patch9
Cisco Identity Services Engine	Version 3.3.0
Cisco Identity Services Engine	Version 3.3.0 patch10
Cisco Identity Services Engine	Version 3.3.0 patch11
Cisco Identity Services Engine	Version 3.3.0 patch1
Cisco Identity Services Engine	Version 3.3.0 patch2
Cisco Identity Services Engine	Version 3.3.0 patch3
Cisco Identity Services Engine	Version 3.3.0 patch4
Cisco Identity Services Engine	Version 3.3.0 patch5
Cisco Identity Services Engine	Version 3.3.0 patch6
Cisco Identity Services Engine	Version 3.3.0 patch7
Cisco Identity Services Engine	Version 3.3.0 patch8
Cisco Identity Services Engine	Version 3.3.0 patch9
Cisco Identity Services Engine	Version 3.4.0
Cisco Identity Services Engine	Version 3.4.0 patch1
Cisco Identity Services Engine	Version 3.4.0 patch2
Cisco Identity Services Engine	Version 3.4.0 patch3
Cisco Identity Services Engine	Version 3.4.0 patch4
Cisco Identity Services Engine	Version 3.4.0 patch5
Cisco Identity Services Engine	Version 3.4.0 patch6
Cisco Identity Services Engine	Version 3.5.0
Cisco Identity Services Engine	Version 3.5.0 patch1
Cisco Identity Services Engine	Version 3.5.0 patch2
Cisco Identity Services Engine	Version 3.5.0 patch3

Configuration B

42 vulnerable

Vulnerable Software	Affected Versions
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch10
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch11
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch1
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch2
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch3
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch4
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch5
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch6
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch7
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch8
Cisco Identity Services Engine Passive Identity Connector	Version 3.1.0 patch9
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch10
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch1
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch2
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch3
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch4
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch5
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch6
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch7
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch8
Cisco Identity Services Engine Passive Identity Connector	Version 3.2.0 patch9
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch10
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch11
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch1
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch2
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch3
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch4
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch5
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch6
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch7
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch8
Cisco Identity Services Engine Passive Identity Connector	Version 3.3.0 patch9
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch1
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch2
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch3
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch4
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch5
Cisco Identity Services Engine Passive Identity Connector	Version 3.4.0 patch6

Related CWEs

CWE-648

Incorrect Use of Privileged APIs

The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

References (2)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

Source: psirt@cisco.com

MitigationVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.