Zero-Day Cisco ISE CISA KEV

An unauthenticated request now roots your Cisco ISE

September 18, 2026·8 min read·Chris Boker, Founder, CVEasy AI
A rust attacker request tile on the left, a green Cisco ISE appliance in the center whose front-controller login gate is skirted by a gold dashed bypass ring, an unauthenticated request landing on an interior admin console panel that emits an ink root shell block, and a right-side rack of downstream network devices reached by policy pushes from the compromised console

The tradition on a Cisco Identity Services Engine deployment is to keep the admin console locked hard, because everything else about the box assumes the admin console is the door. On September 16, 2026, Cisco confirmed that door does not close. An unauthenticated attacker who can reach a Policy Administration Node over the network sends one crafted request to a specific API endpoint, and the appliance treats them as if the login page had already stamped their session on the way in. From that seat, they can execute operating system commands as root. Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 the same day, rated the flaw CVSS 10.0 with a Scope Changed vector, and said PSIRT was already aware of active exploitation. CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities catalog the same day, with a September 19, 2026 remediation deadline for federal civilian agencies.

What the primitive actually is

Cisco describes the root cause as insufficient authentication control on a specific API endpoint. The vendor is deliberately vague about which endpoint carries it, and no independent researcher has posted the request in full, so I am not going to invent one. What the advisory and the corroborating write-ups line up on is the shape of the primitive. A route inside the ISE web application accepts an HTTP request without walking that request through the same authentication filter that guards every other privileged route. Send a message shaped the way that endpoint expects, and the front controller treats you as an already-authenticated administrator.

That is the oldest way for a web management plane to fail, and it always fails the same way: one unprotected route somewhere in the tree collapses the assumption that authentication is a boundary. On ISE the assumption is more load-bearing than usual, because the deployment is the identity source of truth for a whole network. Once the front controller thinks the session belongs to an admin, the rest of the appliance builds a session on that assumption and stops re-checking. The routes reachable from that session include the ones ISE has to keep dangerous to do its job: install patches, upload signed application bundles, mint local administrator accounts, edit the network device inventory, push policy to every switch that trusts the deployment.

Why admin on ISE ends at root on the box

Getting to the admin console on a normal web application is not the same as owning the operating system. On ISE it is very close. The appliance is a locked-down Cisco Application Deployment Engine on top of Red Hat, and the administrative UI exposes routes that need to invoke privileged operating system work to earn their keep: patch installation, application bundle upload and execution, support bundles that read arbitrary files, and the ISE application shell that runs commands under a process account with sudo entries for every operation ISE ships with. Help Net Security and SOC Prime both report that observed exploitation chains through the admin surface into command execution as root, which is what the Scope Changed vector in the CVSS score is telling you.

Even if an attacker never touches the operating system directly, the same seat lets them push policy to every switch and wireless controller that treats the deployment as a RADIUS or TACACS+ source, and quietly disable posture and MFA on entire network segments. That is why one API bypass gets rated CVSS 10.0. The web console is the identity plane.

The severity number will not sort this the way you need

Every scanner in the market surfaces CVE-2026-76460 in its critical bucket this week, and most surface it identically for every ISE box in every deployment, because CVSS 10.0 reads the same at every asset. That is the failure mode. Two Policy Administration Nodes at two organizations carry the same CVE with wildly different real exposure. A PAN whose admin service is reachable from an internet-facing management VPN, or worse from a flat management VLAN with corporate desktops on it, is a red-alert emergency. The same version running a lab deployment on an isolated segment reachable only from a jump host deserves the same patch this cycle but does not deserve the same overnight page. A CVSS-first queue rejects that distinction on principle, and the environmental metrics that could carry it are almost never populated in real triage.

How TRIS layers score this on a real ISE deployment

Inside CVEasy AI, findings run through the Threat and Risk Intelligence Scoring engine, TRIS, which decomposes a finding into signals that a single severity number cannot carry. For CVE-2026-76460, four TRIS layers do most of the work.

Exploitation status. Confirmed in-the-wild abuse before the advisory shipped, per Cisco PSIRT and the same-day CISA KEV addition described by SecurityWeek. TRIS keeps confirmed abuse and a public proof of concept in different tiers, because they mean different things for how fast this needs to move. Confirmed abuse against real customers, which is what Cisco is describing, sits at the top rung.

Reachability. The admin API has to be reachable to the attacker for the primitive to fire. TRIS reads reachability from the deployment itself: which interface the admin service is bound to, whether that interface sits on a management VLAN reachable from user or vendor networks, whether a jump host or ZTNA gateway fronts the console. A PAN reachable from an internet-facing gateway sits at the top of this layer. One reachable only from a locked-down bastion sits lower on the same CVE, and that difference shows up in the queue.

Blast radius. An ISE deployment is a hub, not a leaf. Root on a PAN reaches every switch, wireless controller, and firewall that treats the deployment as an authentication source, plus the RADIUS and TACACS+ shared secrets that make those integrations work. TRIS treats the PAN as a hub node and pulls the score up on every downstream device that trusts it.

Asset criticality. A PAN in the primary production deployment is scored differently from one in a lab. TRIS reads that tag from the inventory rather than asking a person to type it at triage.

Those four layers together move the same CVE from top-band ACT on an exposed production PAN to a lower band on a sandboxed lab node. Both boxes get patched. Only one wakes anybody up tonight.

Confirmed abuse is not the same as a public proof of concept. Cisco has said PSIRT is aware of exploitation. No public proof of concept has been posted at time of writing. Both the offensive side and the defensive side are still moving in relative dark, and the KEV deadline is the number that matters this week, not the presence of a Metasploit module.

Do this before the KEV clock runs out

Patch. Move every ISE and ISE-PIC node to a fixed release. Cisco lists 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 as the first fixed builds in the security advisory. ISE 3.0 is past end of software maintenance and has no fix, so the correct move on 3.0 is a supported release, not a workaround hunt. Cisco is explicit that no configuration setting closes the flaw.

Narrow reachability while you patch. If your change window sits days out, restrict the admin service to a small allowlist of management jump hosts at the firewall and drop everything else. That does not close the vulnerability. It shrinks the attacker population that can reach the endpoint during the patch race.

Hunt. Review ISE audit and system logs from at least a week before the September 16 disclosure, per Qualys ThreatPROTECT. Look for API requests that produced administrative actions without a preceding successful login for the same account, new admin accounts created outside normal change control, policy pushes or network device edits attributed to unfamiliar sessions, and any application or root shell activity that does not match a documented operator. Compare on-disk configuration and script directories against the deployment baseline for the running build.

Rotate. Rotate every credential the deployment touches: local ISE admin accounts, TACACS+ enable secrets and RADIUS shared secrets to every downstream network device, LDAP and Active Directory bind accounts used for identity sources, and the ISE machine account used to join a Windows domain. A root shell on the PAN saw all of those. Do the rotation after the patch, because rotating credentials on a still-vulnerable node hands the new ones back to the same attacker.

ISE 3.0 has no fix. Cisco declared 3.0 past end of software maintenance, and the advisory does not backport. Any 3.0 deployment still in production is an ACT-band exposure until it is off 3.0, and pretending otherwise is how most organizations end up running end-of-life releases in the first place.

How CVEasy AI surfaces this

CVEasy AI, the number one local-first CTEM (Continuous Threat Exposure Management) platform, ingests the Cisco PSIRT advisory, the CISA KEV catalog, and the research write-ups behind them, and runs the finding through TRIS against the deployment you already have on your own hardware. On a customer with an internet-reachable ISE 3.4 Policy Administration Node fronting a production RADIUS fleet, the finding lands in the top ACT band with 3.4 Patch 7 as the target build, the reachability rationale attached, and a rotation checklist scoped to the exact accounts and shared secrets that PAN holds. On a customer with a 3.5 lab node behind a jump host, the same CVE lands lower in the queue with the same patch guidance and stops competing for the on-call engineer this week. The inventory, the ISE audit logs, and the TRIS analysis stay on your hardware, with no cloud data plane in the middle.

Sources: Cisco Security Advisory cisco-sa-ISE-ABP-VNSW7Tn5, The Hacker News, Help Net Security, SOC Prime, SecurityWeek, Qualys ThreatPROTECT