Cisco ISE is a CVSS 10 unauthenticated API. Patching without hunting access.log is not remediation.

CVE-2026-76460, found in a TAC case, is now KEV. No workaround. Root after the bypass. Re-image if the Kong hunt hits.

RWP Ventures · 2026-09-17 · event 2026-09-16 · 12 min read · priority 8.9

CISA added the row on 16 September. Catalog version 2026.09.16, released 16 September 18:47 UTC, count 1713. Federal due date 19 September. Forensic triage: Yes. Ransomware-campaign use: Unknown. The vulnerability was found during resolution of a Cisco TAC case. That is Cisco’s sentence for “at least one customer environment was already in an incident before the advisory existed.”

Do not collapse this with CVE-2026-76423. Same day, also CVSS 10, also an unauthenticated REST API authorization failure, different advisory (cisco-sa-ise-multi-hrP9jQSQ), different CWE (CWE-290), and Cisco PSIRT is not aware of malicious use. 76423 is not on KEV. Patch trains overlap. Hunting and KEV clocks do not.

What happened

Cisco published a cluster of ISE advisories at 16:00 GMT on 16 September. The exploited row is a dedicated advisory, not a line in the multi-CVE note. Insufficient authentication control on an API endpoint. Crafted request. Bypass of the web management interface. Cisco’s exploitation section is one sentence and it is enough: “The Cisco PSIRT is aware of active exploitation of this vulnerability.” Source: TAC. No actor, no campaign name, no victim count.

CISA’s “adds two” alert the same calendar day listed 76460 next to Acronis Backup CVE-2026-87886. A separate CISA “adds one” covered Google Pixel modem CVE-2026-58704. Live KEV JSON 2026.09.16 carries all three, each with due 19 September and forensic triage Yes. Only 76460 is an unauthenticated, configuration-independent identity-plane appliance with Cisco-confirmed in-the-wild use and a Changed-scope 10.0.

NVD published 76460 at 16 September 21:17 UTC, last-modified 17 September 04:18 UTC. Cisco is the CVSS source. English secondary coverage (BleepingComputer 17 September 03:20, The Hacker News, SecurityWeek) landed after [yesterday’s Daily Top](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/) had already shipped.

Cisco’s own hunt language is more operational than the CVSS. Review access.log for suspicious usernames, on every node in a distributed deployment. Example (Cisco’s, non-exhaustive): show logging application ise-kong/access.log | include dummyuser. Additional files live in a support bundle with debug logs selected, under ./ise/logs/apigateway/access.log..gz. Any hit is a reason to treat the node as hostile. Cisco’s remediation if you suspect activity is re-image and restore from configuration backup — not “patch in place and declare KEV closed.” Successful exploitation may yield root command execution. Evidence on the box may already be gone. Cross-check uploads and downloads on off-box network and firewall logs.

Why it matters

Three facts should not be collapsed.

First: ISE is the NAC, not a switch. [FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) was unauthenticated root on the firewall manager. [SEG CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/) is unauthenticated root on the mail parser. [vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/) is unauthenticated RCE on the hypervisor control plane, now KEV-flagged for ransomware use. ISE is the fourth control-plane class this month: the appliance that decides who is on the network. 802.1X, VPN posture, guest, profiling, pxGrid, SGT. An unauthenticated API that bypasses the admin UI is not “a web bug on an AAA product.” It is a door into the policy that admits every other door.

Second: “regardless of device configuration” kills the usual compensation story. You cannot disable a feature you did not know was the attack surface. iACLs that allow only required management and control-plane traffic are Cisco’s mitigation. They are not a workaround, and they do not clean a node that already answered the crafted request. Scope is Changed. Cisco scored confidentiality, integrity, and availability all High. The PSIRT’s root-execution sentence is why forensic triage is Yes and why a patched build string is not eradication.

Third: this is not confirmed OT impact. ISE sitting at an IT/OT boundary, authorizing engineering workstations or jump hosts onto a process VLAN, is still an IT compromise of the access-control plane at an industrial organization. No PLC, no HMI, no physical-process evidence is in the public record. Do not staple a NAC incident to a plant event.

Who / what is affected

Technical context

RWP is not reproducing an API payload. Cisco’s public description is enough for a defender: an API endpoint failed to enforce authentication (CWE-648, incorrect use of privileged APIs); an unauthenticated network caller can obtain unauthorized access by bypassing the web management interface. Scope Changed. No workaround.

Kong access.log is the hunt Cisco published. dummyuser in the example command is Cisco’s illustration of a suspicious username string, not a confirmed actor handle. Treat unexpected usernames, not that literal, as the signal. Distributed deployments fail closed only if you query every node. The gzipped API-gateway logs in the support bundle are the second copy; they exist because the live file rotates.

76423 is a second unauthenticated door on the REST API (CWE-290, authentication bypass by spoofing). Cisco scored it 10.0 with S:C and A:L in one NVD vector and described administrative read/modify of configuration and identity data. STAR Labs SG reported that cluster. PSIRT: no known malicious use. Do not hunt 76423 playbooks and call 76460 closed. Do not skip 76423 because it missed KEV. The September hardening release and the 3.1 P12 / 3.2 P11 / 3.3 P12 / 3.4 P7 / 3.5 P4 trains are how you pick both up.

July 2025 CVE-2025-20337 (IdentityAuditAction web shell) is prior ISE zero-day tradecraft. It is not this CVE.

ATT&CK mapping for what is stated:

• Initial access: exploit public-facing application on ISE (T1190).
• Defense evasion / persistence risk: indicator removal on host (T1070) — Cisco’s own warning that root can hide evidence.
• Execution: command execution as root (T1059), stated by Cisco as a possible post-bypass outcome, not as a separate CVE.

Follow-on that is not claimed here: named C2, a named ransomware brand, pxGrid abuse specifics, or identity of 76460 with 76423 or with 2025-20337.

Threat / exploitation status

High confidence on: CVE identifier, CVSS vector, product and fixed-version matrix, configuration independence, absence of workarounds, KEV dates, forensic-triage flag, distinctness from 76423, TAC-as-source. Moderate confidence that internet-reachable admin/API listeners are the practical target set (PR:N does not require a census). Low confidence on actor, current victim count, and whether a patched node still hosts a TAC-era implant.

What defenders should do

1. Inventory every ISE and ISE-PIC you actually run — PAN, PSN, MnT, pxGrid, PIC, lab, DR, the “temporary” internet jump. Record train and patch. If 443 or the REST API answers from a network that is not the management VLAN, treat it as exposed until the ACL is proven off-box.

1. Hunt before you close the ticket. Forensic triage is Yes. Cisco’s hunt is Kong access.log for unexpected usernames, on every node, plus the API-gateway gzip in the support bundle. Then leave the box: firewall and network logs for unexpected uploads from the ISE IP or downloads to it. Preserve logs and snapshots before you replace the VM. A new node with a clean patch destroys the disk you needed.

1. Patch to the 76460 matrix. 3.1 → Patch 12. 3.2 → Patch 11. 3.3 → Patch 12. 3.4 → Patch 7. 3.5 → Patch 4. 3.0 → migrate. There is no workaround to hide behind. iACLs that allow only required management and control-plane traffic are the mitigation while you patch; they do not replace the patch.

1. If exploitation is suspected: isolate management and API listeners, re-image, restore from a known-clean configuration backup, rotate admin, service, pxGrid, and any secrets the node could have touched, and treat connected NAD/switch/VPN estates as in-scope for policy-integrity review. Do not confuse a patched build with eradication. Cisco’s words are re-image, not hotfix-in-place.

1. Do not skip 76423 because it is not on KEV. Same calendar day, same identity plane, second unauthenticated CVSS 10. The multi-CVE advisory and the hardening release ride the same trains for 3.3/3.4/3.5; 3.1/3.2 pick up 76423 on the 76460 patches and must migrate for several of the sibling bugs.

1. Sequence the rest of this week’s clock. [Cisco SEG CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/) is KEV-due today, 17 September. [vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/) is ransomware-Known, forensic triage still Yes, federal clock already expired. Pixel CVE-2026-58704 and Acronis CVE-2026-87886 are KEV-due 19 September with this row — different products, do not steal ISE owners. [ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/) and [GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/) are overdue. Artifactory CVE-2026-42016 / 42018 due 25 September.

This is not an exploitation guide. Use Cisco’s advisory and off-box logs.

RWP assessment

Score 8.9. Unauthenticated CVSS 10 on the NAC/identity control plane, configuration-independent, Cisco-confirmed in the wild via a TAC case, KEV’d the same day with forensic triage and a 19 September clock. That is the first material development after [yesterday’s vCenter ransomware-use flag](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/). RWP has not published 76460 as a Daily Top.

It outranks Pixel CVE-2026-58704 (adjacent-network modem EoP, CVSS 8.8, Google “limited, targeted,” Pixel bulletin High — real, KEV’d, not an enterprise control plane). It outranks Acronis CVE-2026-87886 (Linux LPE in a cPanel/WHM backup plugin; vendor “limited, targeted”; BleepingComputer: assessment based on a single potentially affected customer). It outranks same-day CVE-2026-76423 on evidence quality: CVSS 10, not exploited, not KEV. It is not a re-run of [SEG 76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/) (due today) or [FMC 20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/). CHOSEN BRICK (Iranian Windows malware against dissidents, activists, journalists) is a separate government advisory and not this appliance. CISA discontinuing the weekly vulnerability bulletin on 28 September is process news. The 15 September ICS batch still has no exploitation claim.

The TAC origin is the sentence operators should not sand down. A PSIRT that learned this from a support case is telling you the first victim was already inside the product before the CVE existed. Patching that node without the Kong hunt is how you leave the NAC in the attacker’s policy.

What we are watching

• Whether Cisco, CISA, or a national CERT names an actor, publishes IoCs beyond the Kong hunt, or flips ransomware-use from Unknown.
• Whether 76423 or any other 16 September ISE CVE lands on KEV.
• Internet-exposed ISE admin/API counts versus patched-build evidence.
• SEG 76461 through 17 September; Pixel 58704 and Acronis 87886 through 19 September.
• Any attempt to treat an ISE compromise at an industrial tenant as an OT event without process evidence.

Sources

• Cisco PSIRT — cisco-sa-ISE-ABP-VNSW7Tn5 (CVE-2026-76460)
• Cisco PSIRT — cisco-sa-ise-multi-hrP9jQSQ (CVE-2026-76423 and siblings)
• Cisco PSIRT — September 16, 2026 advance notification
• CISA — Adds Two Known Exploited Vulnerabilities to Catalog (16 September 2026)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-76460
• CISA KEV JSON feed
• CISA — BOD 26-04
• NVD — CVE-2026-76460
• NVD — CVE-2026-76423
• BleepingComputer — Cisco warns of max severity ISE zero-day exploited in attacks (17 September 2026)
• The Hacker News — Cisco Warns of New Zero-Day ISE Auth Bypass (17 September 2026)
• SecurityWeek — Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day
• [RWP Daily Top, 16 September 2026 — vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/)
• [RWP Daily Top, 15 September 2026 — Cisco SEG CVE-2026-76461](/posts/2026-09-15-cisco-seg-cve-2026-76461-sqli/)
• [RWP Daily Top, 14 September 2026 — ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)