Cisco has released an emergency patch for a vulnerability in Cisco Identity Services Engine (ISE) that is being actively exploited in the wild. Per the SecurityWeek report, remote, unauthenticated attackers can exploit the flaw to bypass authentication by sending crafted requests to vulnerable ISE deployments — no credentials, no user interaction, no prior foothold required. That combination of attributes is about as dangerous as it gets for a product that sits at the center of your network access control architecture.
If you run ISE, this is a drop-everything event. ISE is not just another appliance — it is the policy decision point for 802.1X, guest access, device profiling, and posture enforcement across wired, wireless, and VPN access. An attacker who bypasses ISE authentication is not merely compromising a server; they are compromising the control plane that decides who and what is allowed onto your network. Treat every unpatched, reachable ISE node as potentially compromised until proven otherwise.
This post walks through what we know about the vulnerability, how to detect exploitation attempts and post-compromise activity, and the exact remediation steps your team should execute today.
Why This Matters Beyond the Appliance Itself
In my IR engagements, the systems attackers prize most are the ones that grant implicit trust: identity providers, VPN concentrators, and NAC/policy platforms. ISE checks all three-adjacent boxes. A successful authentication bypass against ISE can enable an adversary to:
- Manipulate authorization policies — reclassify attacker-controlled endpoints as compliant, or move rogue devices into trusted VLANs and security groups (SGTs).
- Harvest or weaken network authentication — tamper with RADIUS/TACACS+ behavior, certificate-based EAP configurations, or guest portal logic.
- Use ISE as a pivot — ISE nodes typically hold integrations with Active Directory, PKI, MDM, and pxGrid-connected security tools. Each integration is a credential or trust relationship an attacker can abuse.
- Disable visibility — alter logging, purge session data, or weaken profiling so follow-on movement goes unnoticed.
Active exploitation means threat actors have working exploit code and are using it now. Assume scanning for exposed ISE management and portal interfaces began the moment details became public, if not before.
Technical Analysis
What is affected
Cisco ISE and ISE Passive Identity Connector (ISE-PIC) deployments are the products in scope. The vulnerability is exploitable remotely over the network and requires no authentication — the attacker only needs network reachability to the affected service interfaces. This makes the exposure question the single most important triage item: any ISE management, admin, or portal interface reachable from untrusted segments (and especially from the internet) is at immediate risk.
How the attack works (defender's view)
The reported mechanism is an authentication bypass via crafted requests — the attacker sends specially constructed requests to the vulnerable service and is granted access they should never have received. From a defender's perspective, this class of flaw has a consistent observable signature:
- Pre-authentication attack surface: The malicious requests arrive at a web/API endpoint before any valid session exists. In logs, you will see requests hitting application endpoints with no corresponding successful authentication event, or authentication events that appear anomalous (success with no valid credential exchange, unexpected source, or unusual client characteristics).
- Post-bypass activity: Once the attacker has session-level or admin-level access, expect configuration reads (policy export, endpoint inventory), account creation or modification, and — depending on the depth of access — command execution on the underlying ISE Linux platform.
- Reachability is the exploit prerequisite: Crafted requests can only arrive where routing permits. Segmentation of ISE admin interfaces is both a mitigation and a detection opportunity.
Exploitation status
- Confirmed active exploitation in the wild — this is not a theoretical or PoC-only scenario. Cisco issued an out-of-band/emergency patch, which vendors reserve for the most urgent situations.
- No public authentication required: any exposed instance should be treated as a target.
- Check the CISA Known Exploited Vulnerabilities catalog for inclusion and any associated federal remediation deadline; actively exploited Cisco vulnerabilities have historically been added quickly, and a KEV listing carries a binding deadline for federal agencies and a de facto deadline for everyone else.
Detection & Response
Detection for this threat centers on three telemetry sources: (1) ISE application and system logs forwarded via syslog to your SIEM, (2) network-layer observation of who is talking to ISE interfaces, and (3) host-level activity on the ISE platform itself. Because the exploit operates pre-authentication, the highest-fidelity signal is access to application functionality without a preceding legitimate authentication event, and traffic to ISE management/API endpoints from sources outside your defined management subnets.
If you are not already forwarding ISE logs (system, admin audit, and diagnostics) to your SIEM, that is your first gap to close — ISE's own local logging is the first thing a competent attacker will try to suppress.
---
title: Cisco ISE Management or API Access from Non-Management Source
title_note: Authentication bypass exploitation requires reachability to ISE admin/API endpoints - restrict alert scope to known management networks
id: 3c8a2f91-7b44-4e12-a9d6-5f1c8e2b7d40
status: experimental
description: Detects network connections to Cisco ISE administrative, ERS, or portal service ports originating from source addresses outside authorized management infrastructure. Crafted-request authentication bypass attacks against ISE require network reachability to these services, and legitimate admin access should originate only from defined jump hosts and NOC subnets.
references:
- https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
logsource:
category: firewall
product: cisco
detection:
selection_ports:
DestinationPort:
- 443
- 8443
- 9060
- 9061
filter_mgmt:
SourceIp|cidr:
- '10.0.0.0/8' # REPLACE with your authorized management/NOC subnets
- '192.168.10.0/24'
condition: selection_ports and not filter_mgmt
falsepositives:
- Legitimate portal access from guest/user segments (tune by ISE node role - PSN portals are user-facing by design)
- Misconfigured load balancer health checks
level: high
---
title: Cisco ISE Administrative Audit Events Indicating Unauthorized Configuration Change
id: 9d14e7c2-3f58-4b91-8a2c-6e0d5f3b1892
status: experimental
description: Detects Cisco ISE admin audit syslog events for account creation, administrative login anomalies, or policy configuration changes. Following an authentication bypass, attackers typically create persistence accounts or modify authorization/profiling policies. ISE forwards these events via remote logging targets - alert on them in near-real-time rather than discovering them in weekly reviews.
references:
- https://www.securityweek.com/active-exploitation-triggers-emergency-patch-for-cisco-ise-zero-day/
- https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1136
- attack.defense_evasion
- attack.t1562
logsource:
product: cisco
service: ise
detection:
selection_admin:
Message|contains:
- 'Administrator added'
- 'Admin user created'
- 'User account created'
- 'password changed'
selection_policy:
Message|contains:
- 'Authorization policy'
- 'Network device added'
- 'Logging target deleted'
- 'Remote logging target'
condition: 1 of selection_*
falsepositives:
- Scheduled administrative change windows (suppress by correlating with change tickets)
- ISE administrators performing normal policy work
level: high
The second rule is deliberately scoped to ISE admin audit message patterns rather than generic syslog — a broad "any ISE error" rule would be disabled within a week. Tune the message strings against your own ISE version's audit output; the categories (account lifecycle, authorization policy, logging configuration) are the durable detection logic, because disabling remote logging and creating persistence accounts are the two moves attackers reliably make after gaining admin access to a policy platform.
// Hunt: connections to Cisco ISE admin/API interfaces from outside authorized management space
// Requires firewall/NetFlow data in Sentinel and ISE syslog via CEF ingestion
let MgmtSubnets = dynamic(["10.10.0.0/16", "192.168.10.0/24"]); // REPLACE with your authorized admin subnets
let IseNodes = dynamic(["10.20.1.11", "10.20.1.12"]); // REPLACE with your ISE node IPs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationIP in (IseNodes)
| where DestinationPort in (443, 8443, 9060, 9061)
| where not(ipv4_is_in_any_range(SourceIP, MgmtSubnets))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count(), Ports=make_set(DestinationPort) by SourceIP, DestinationIP, DeviceAction
| order by RequestCount desc;
// Hunt: ISE admin audit events showing account or policy manipulation post-bypass
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("Administrator added", "Admin user created", "User account created", "password changed", "Authorization policy", "Network device added", "logging target")
| project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc;
// Hunt: successful admin authentication events lacking a preceding credential exchange (anomaly pivot)
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has ("Administration successful Login") or SyslogMessage has ("admin login succeeded")
| extend SourceIp = extract(@"([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})", 1, SyslogMessage)
| summarize Logins=count(), Messages=make_set(SyslogMessage, 5) by SourceIp, Computer
| order by Logins desc;
-- Hunt for suspicious child processes spawned by Cisco ISE service components
-- Post-exploitation on a compromised ISE node typically yields shells or tooling
-- parented to the ISE application stack (tomcat/java, radiusd, or ISE scripts).
-- Deploy to ISE-adjacent Linux collectors or run during IR acquisition on the node.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
pslist(pid=Ppid).Name AS ParentName,
pslist(pid=Ppid).CommandLine AS ParentCommandLine
FROM pslist()
WHERE (ParentName =~ '(?i)java|tomcat|radiusd|ise' OR ParentCommandLine =~ '(?i)/opt/CSCOcpm|ise')
AND Name =~ '(?i)bash|sh|dash|python|perl|curl|wget|nc|ncat|socat|chmod|chown'
#!/bin/bash
# Cisco ISE emergency patch verification and exposure audit
# Run against each ISE node (PAN/PSN/MnT). Requires CLI admin access via SSH.
ISE_NODES="ise-pan1.corp.local ise-psn1.corp.local ise-psn2.corp.local"
SSH_USER="iseadmin"
for node in $ISE_NODES; do
echo "==================== $node ===================="
# 1. Confirm software version and applied patches
ssh ${SSH_USER}@${node} "show version"
ssh ${SSH_USER}@${node} "show application version ise"
# 2. Verify node roles and uptime (unexpected reboots can indicate tampering)
ssh ${SSH_USER}@${node} "show nodes"
ssh ${SSH_USER}@${node} "show uptime"
# 3. Inventory local admin accounts - flag anything not in your change records
ssh ${SSH_USER}@${node} "show running-config | include username"
# 4. Verify remote logging targets are still configured (attackers delete these first)
ssh ${SSH_USER}@${node} "show logging | include remote"
done
# 5. From your network side, audit external exposure of ISE service ports.
# Admin (443/8443), ERS API (9060), and portal services should NOT be internet-reachable.
# Run from an external vantage point against your public ranges:
# nmap -Pn -p 443,8443,9060,9061 <your_public_ranges> -oG ise_exposure_scan.txt
# grep "open" ise_exposure_scan.txt
echo ""
echo "ACTION ITEMS:"
echo "[ ] Confirm every node is on a patched ISE release per the Cisco advisory"
echo "[ ] Any unknown admin account -> disable immediately, preserve logs, open IR case"
echo "[ ] Missing remote logging targets -> reconfigure and treat node as suspect"
echo "[ ] Any internet-reachable ISE admin/API port -> firewall deny rule TODAY"
Remediation
Execute in this order — patching is necessary but not sufficient if exploitation predates the patch.
-
Apply the emergency patch immediately. Download the patched ISE release from Cisco's software center and follow the official advisory linked from the Cisco Security Advisories portal. Patch the Primary Administration Node first, then MnT and PSN nodes per Cisco's documented upgrade order. Verify patch application with
show application version iseon every node — do not assume a successful deployment. -
Eliminate exposure in parallel. While the patch window is being scheduled, enforce network-layer restrictions:
- ISE administrative interfaces and the ERS API must be reachable only from dedicated management subnets and jump hosts. If they are reachable from user VLANs, guest networks, or — worst case — the internet, fix that today with ACLs/firewall policy. This is a durable control, not a workaround.
- Audit external-facing ranges for ISE service ports (see the scan step in the script above).
-
Hunt before you patch if possible; hunt regardless after. Capture and preserve ISE logs (local and remote targets) before rebooting nodes for the patch. Then run the detection content above against the preceding 30 days of syslog and firewall telemetry. Indicators of compromise: unexplained admin accounts, authorization policy or network device changes outside change windows, deleted/modified remote logging targets, unexpected node reboots, and admin-interface connections from non-management sources.
-
Rotate credentials on any suspect node. If hunting surfaces anything anomalous — or if the node was internet-exposed while unpatched — rotate the ISE CLI/admin passwords, the ERS API credentials, and any service accounts ISE uses to integrate with AD, PKI, and pxGrid peers. A bypass means you cannot trust what the attacker touched.
-
Verify integrity of policy configuration. Export current authorization policies, network device definitions, and certificate configurations; diff against a known-good backup. Attackers with admin access to ISE commonly insert a quiet exception (a permissive authz rule, a trusted MAC, a rogue NAD entry) rather than making noisy changes.
-
Monitor CISA KEV and Cisco advisories for updates. If this vulnerability is added to the CISA KEV catalog, note the remediation due date — and hit it even if you are not a federal agency. KEV deadlines are a useful forcing function for executive prioritization.
-
Close the telemetry gap permanently. If ISE admin audit, system, and diagnostic logs are not already flowing to your SIEM with alerting on account lifecycle and logging-configuration events, that is a standing architectural weakness. The organizations that catch these intrusions early are the ones watching the control plane, not just the endpoints behind it.
The Bottom Line
An unauthenticated authentication bypass in your network access control platform, under active exploitation, is a worst-case identity-infrastructure scenario. The patch is the headline, but the defensive work is the follow-through: restrict reachability, hunt for pre-patch compromise, rotate what you cannot trust, and instrument ISE so the next emergency advisory finds you with eyes open rather than blind. The adversaries exploiting this flaw understand exactly how much trust your network places in ISE. Your detection posture should reflect the same understanding.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.