CVE-2026-76460: Cisco ISE API Authentication Bypass — Detection, Containment, and Remediation Guide

Cisco Identity Services Engine (ISE) is back in the blast radius. The reported flaw tracked as CVE-2026-76460 is described as an authentication bypass affecting API endpoints in Cisco ISE and carries a maximum CVSS 10.0 score. In plain terms: if the vulnerable API surface is reachable, an attacker may be able to interact with ISE without proving identity first.

That is about as bad as it gets for a NAC/identity platform. ISE frequently holds the keys to network admission policy, guest access, device profiling, endpoint posture, RADIUS/TACACS+ integrations, certificate workflows, pxGrid context sharing, and administrative configuration. An authentication bypass at the API layer is not merely a web bug; it is a potential control-plane compromise for wired, wireless, VPN, and segmentation policy.

Defenders should treat this as an emergency change event even before confirming exploitation in their own estate. The news summary states the issue is unpatched at time of reporting and highlights API endpoint authentication failures. Until Cisco publishes fixed releases and you have deployed them, the correct posture is: reduce reachability, increase logging, hunt for anomalous API success, and assume any Internet-exposed or broadly reachable ISE API interface is hostile territory.

Source: Dark Reading. Track the CVE and fixed-software data through Cisco's advisory portal: Cisco Security Advisories.

Technical Analysis

Affected products and exposure

Based on the provided reporting, the impacted product family is Cisco Identity Services Engine (ISE) and the weakness is in API endpoint authentication. The specific vulnerable versions, fixed releases, and exact endpoint paths were not included in the news summary, so do not guess from blog headlines. Pull the affected/fixed matrix directly from the Cisco advisory for CVE-2026-76460 and map it to every ISE node in your deployment: primary and secondary PANs, MnT nodes, PSNs, pxGrid nodes, and any standby/disaster-recovery instances.

Operationally, prioritize nodes by exposure:

1. Any ISE management or API interface reachable from the Internet, partner networks, MPLS/SD-WAN segments with weak trust boundaries, or flat user VLANs.
2. PAN and MnT nodes, because administrative and monitoring context can enable rapid policy manipulation and collection of high-value telemetry.
3. PSNs exposed to large endpoint populations for RADIUS, guest, posture, or profiling services.
4. pxGrid/ERS/OpenAPI integrations where service accounts, certificates, or network ACLs were loosely scoped.

Vulnerability mechanics from a defender's perspective

The reported class is API authentication bypass. The precise root cause is not described in the summary, so defenders should focus on the observable security failure rather than speculate about code paths: requests to protected ISE API routes are succeeding without valid authentication material, with insufficient session validation, or after logic errors that confuse unauthenticated and authenticated request handling.

The most dangerous outcomes are not simply reading status pages. On an identity/NAC platform, unauthenticated API access could plausibly enable policy discovery, enumeration of endpoints and identity groups, extraction of configuration or logs, creation or modification of authorization policy, manipulation of guest/sponsor workflows, certificate or trust changes, and pivoting into integrated systems through pxGrid/ERS service accounts. Even if the vulnerable endpoint is narrow, a CVSS 10.0 authentication bypass in a policy enforcement product should be handled as a potential precursor to full administrative control.

Exploitation requirements are likely to be low if the route is network-reachable and no compensating control blocks it. The biggest variable is reachability: a vulnerable node isolated to a tightly ACL'd management network is a very different problem from a PSN or portal node reachable by thousands of endpoints.

Exploitation status

The supplied item reports an unpatched, maximum-severity issue. It does not explicitly confirm public PoC, CISA KEV inclusion, or active exploitation. Treat those as unknown until verified from Cisco, CISA KEV, and your own telemetry. Do not wait for a PoC to begin containment; API auth bypasses in edge and identity products tend to attract fast scanner and exploit development once details circulate.

Detection & Response

The highest-fidelity early signal is successful API activity without corresponding authentication, especially from networks that should never touch ISE management/API interfaces. Baseline normal API consumers first: ISE nodes talking to each other, MnT collectors, SIEM pullers, automation systems, TACACS+/RADIUS infrastructure, pxGrid subscribers, and approved jump hosts. Then alert hard on deviations.

---
title: Cisco ISE API Success Without Authentication Context
id: 8f7b2c11-4f89-4d9f-b0de-cve202676460
status: experimental
description: Detects successful requests to Cisco ISE administrative/API paths where no Authorization header, session cookie, or client certificate context is present in proxy/WAF/load balancer logs. Tune the URI list to the routes confirmed in the Cisco advisory.
references:
  - https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues
  - https://sec.cloudapps.cisco.com/security/center/publicationListing.x
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.76460
logsource:
  category: proxy
detection:
  selection_uri:
    cs-uri|contains:
      - '/ers/'
      - '/admin/'
      - '/api/'
      - '/pxgrid/'
      - '/ise/'
  selection_status:
    sc-status:
      - 200
      - 201
      - 202
      - 204
  filter_auth_present:
    cs-authorization|contains:
      - 'Bearer'
      - 'Basic'
    cs-cookie|contains:
      - 'JSESSION'
      - 'SESSION'
      - 'ISE'
  condition: selection_uri and selection_status and not filter_auth_present
falsepositives:
  - Health checks that intentionally return 200 on unauthenticated status endpoints
  - Misconfigured API gateways that strip authorization headers before logging
level: high
---
title: Cisco ISE API Authentication Bypass Probe Pattern
id: 2a1c8f90-77b4-4c2d-9a11-9e0c4b7d2150
status: experimental
description: Detects repeated authentication failures against ISE API paths followed by a successful response from the same source, consistent with probing or bypass attempts.
references:
  - https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues
  - https://attack.mitre.org/techniques/T1110/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.credential_access
  - attack.t1110
  - attack.initial_access
  - attack.t1190
  - cve.2026.76460
logsource:
  category: proxy
detection:
  selection:
    cs-uri|contains:
      - '/ers/'
      - '/admin/'
      - '/api/'
      - '/pxgrid/'
      - '/ise/'
    sc-status:
      - 401
      - 403
      - 200
  timeframe: 10m
  condition: selection | count() by c-ip > 20
falsepositives:
  - Broken automation with expired credentials
  - Monitoring platforms using incorrect API credentials
level: medium
---
title: Cisco ISE High-Risk Configuration API Operations
id: 5db84e60-1c2b-4b3d-8f55-71a0a1e4c901
status: experimental
description: Detects high-risk write, export, account, certificate, or policy operations against Cisco ISE API paths from sources outside the approved management allowlist.
references:
  - https://www.darkreading.com/vulnerabilities-threats/cisco-zero-day-api-endpoint-authentication-issues
  - https://attack.mitre.org/techniques/T1098/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.persistence
  - attack.t1098
  - attack.valid_accounts
  - attack.t1078
  - cve.2026.76460
logsource:
  category: proxy
detection:
  selection:
    cs-method:
      - POST
      - PUT
      - PATCH
      - DELETE
    cs-uri|contains:
      - 'config'
      - 'backup'
      - 'export'
      - 'user'
      - 'admin'
      - 'certificate'
      - 'policy'
      - 'trust'
      - 'guest'
      - 'endpoint'
  filter_allowlist:
    c-ip|startswith:
      - '10.10.8.'
      - '10.10.9.'
  condition: selection and not filter_allowlist
falsepositives:
  - Emergency administrative work from an unapproved jump host
  - New automation not yet added to the management allowlist
level: critical

// Hunt for successful Cisco ISE API requests without normal management context.
// Assumes Cisco ISE, load balancer, WAF, or firewall logs are sent to Sentinel as CEF/Syslog.
let ApprovedMgmt = dynamic(["10.10.8.0/24","10.10.9.0/24","192.168.20.0/24"]); // replace with real management ranges
let ApiPaths = dynamic(["/ers/","/admin/","/api/","/pxgrid/","/ise/","backup","export","config","certificate","policy","guest","endpoint"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has "Cisco" or DeviceProduct has_any ("ISE","Identity Services Engine","Firepower","ASA") or SourceIP != ""
| extend Url = coalesce(RequestURL, AdditionalExtensions)
| where isnotempty(Url)
| where Url has_any (ApiPaths)
| extend SrcIP = coalesce(SourceIP, DeviceAddress)
| extend IsApproved = SrcIP has "10.10.8." or SrcIP has "10.10.9." or SrcIP has "192.168.20." // keep explicit to avoid CIDR parser differences
| where not(IsApproved)
| summarize Requests=count(), Methods=make_set(RequestMethod), Status=make_set(ApplicationProtocol), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleUrls=make_set(Url, 10) by SrcIP, DestinationIP, DestinationPort, DeviceAction
| where Requests > 5 or DeviceAction has_any ("success","allowed","permit","200","201")
| sort by Requests desc;

// ISE syslog/CEF: look for admin/config/API outcomes preceded by auth failures from same source.
let Window = 15m;
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("ISE","ERS","pxGrid","admin","api","authentication failed","login failed","Authorization")
| extend Failed = SyslogMessage has_any ("authentication failed","login failed","401","403","unauthorized","forbidden")
| extend Success = SyslogMessage has_any ("200 OK","created","updated","deleted","exported","backup","login success","administrator")
| summarize FailedCount=countif(Failed), SuccessCount=countif(Success), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Samples=make_set(SyslogMessage, 5) by HostIP, Computer
| where FailedCount >= 3 and SuccessCount >= 1 and datetime_diff("minute", LastSeen, FirstSeen) <= 15
| sort by FailedCount desc;

-- Hunt endpoints/servers for unexpected outbound connections to likely ISE admin/API services.
-- Run from domain-joined Windows/Linux infrastructure where Velociraptor is deployed; tune ports and ISE IPs first.
SELECT Pid, Name, Path, Family, Type, Status, Laddr, Lport, Raddr, Rport, Timestamp
FROM netstat()
WHERE Status =~ 'ESTABLISHED|SYN_SENT|CLOSE_WAIT'
  AND Rport in (443, 8443, 8910, 9060, 12006)
  AND NOT Raddr =~ '^(10\\.10\\.8\\.|10\\.10\\.9\\.|192\\.168\\.20\\.)'
  AND NOT Name =~ '^(chrome|msedge|firefox|svchost|System)$'

#!/usr/bin/env bash
# Cisco ISE CVE-2026-76460 exposure triage: verify reachability, identify exposed API listeners, and produce an emergency ACL candidate list.
# Run from a secured jump host. Change MGMT_ALLOWED and ISE_NODES before use.
set -euo pipefail

MGMT_ALLOWED=("10.10.8.0/24" "10.10.9.0/24" "192.168.20.0/24")
ISE_NODES=("ise-pan1.example.local" "ise-pan2.example.local" "ise-mnt1.example.local" "ise-psn1.example.local")
PORTS=(443 8443 8910 9060 12006)
OUT="ise_cve_2026_76460_triage_$(date +%Y%m%d_%H%M%S).csv"

echo "node,port,open,banner_or_tls,source_network_check" > "$OUT"
for node in "${ISE_NODES[@]}"; do
  for port in "${PORTS[@]}"; do
    if timeout 3 bash -c "</dev/tcp/$node/$port" 2>/dev/null; then
      banner="$(timeout 4 openssl s_client -connect "$node:$port" -servername "$node" </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates 2>/dev/null | tr '\n' ' ' || true)"
      echo "$node,$port,OPEN,\"$banner\",verify-source-is-not-user-or-internet" >> "$OUT"
      echo "[ALERT] $node:$port reachable from this host. Confirm source is inside approved MGMT_ALLOWED only."
    else
      echo "$node,$port,closed_or_filtered,,ok" >> "$OUT"
    fi
  done
done

echo
echo "Approved management ranges to enforce at firewall/LB/ISE interface ACLs:"
printf '  %s\n' "${MGMT_ALLOWED[@]}"
echo "Evidence file: $OUT"
echo "Next: block all non-approved sources to ISE admin/API ports, then confirm with an external scan from a non-management subnet."

# Windows-side collection helper: export local evidence of unexpected outbound sessions to ISE admin/API ports and recent admin tool execution.
# Run elevated on jump hosts, automation servers, and suspicious endpoints. Tune $IseSubnets and ports first.
$IseSubnets = @('10.10.8.','10.10.9.','192.168.20.')
$ApiPorts = @(443,8443,8910,9060,12006)
$Out = "$env:ProgramData\SecurityArsenal\ISE-CVE-2026-76460-$(Get-Date -Format yyyyMMdd_HHmmss)"
New-Item -ItemType Directory -Force -Path $Out | Out-Null

Get-NetTCPConnection | Where-Object {
  $ApiPorts -contains $_.RemotePort -and
  ($_.State -in @('Established','SynSent','CloseWait')) -and
  -not ($IseSubnets | ForEach-Object { $_ } | Where-Object { $_.RemoteAddress -like "$_*" })
} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,
  @{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}},
  @{n='Path';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path}} |
  Export-Csv "$Out\unexpected_ise_api_connections.csv" -NoTypeInformation

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match '(curl|powershell|pwsh|python|java|wget|Invoke-RestMethod|Invoke-WebRequest|psql|openssl)' } |
  Select-Object TimeCreated,Id,Message | Export-Csv "$Out\process_creation_api_clients.csv" -NoTypeInformation

Write-Host "Evidence written to $Out. Preserve firewall, WAF, load balancer, ISE MnT, and RADIUS/TACACS logs before rotation."

Immediate containment priorities

Do these before you finish reading the advisory twice.

• Remove broad reachability now. ISE admin/API interfaces should be reachable only from a named management VRF/VLAN, privileged access workstations, approved automation controllers, SIEM collectors, and documented integration partners. Block user VLANs, guest networks, server DMZs unless explicitly required, partner networks, and the Internet.
• Front ISE APIs with an enforcing control. Put administrative and API traffic behind a firewall, WAF, API gateway, or reverse proxy that enforces source allowlists, mTLS where supported, request method restrictions, and full header/body logging. Do not rely on "the endpoint requires auth" as the only control.
• Disable or restrict nonessential API surfaces until patched. If ERS, guest, portal, OpenAPI, or integration APIs are not required for operations during the emergency window, shut them down or ACL them to the smallest possible set of consumers. Re-enable deliberately after fixed code is deployed.
• Rotate secrets that ISE can influence. If there is any chance an unauthenticated actor reached configuration, export, certificate, identity, guest, endpoint, or policy functions, rotate ISE admin credentials, API/service account passwords, pxGrid client certificates where operationally feasible, TACACS+/RADIUS shared secrets used in integrations, and any tokens stored by automation that calls ISE.
• Snapshot and preserve. Capture ISE configuration backups, MnT logs, admin audit trails, authentication logs, pxGrid/ERS logs, load balancer/WAF logs, firewall flows, and VM snapshots before aggressive cleanup. For a CVSS 10 auth bypass, assume forensic value may matter later.
• Hunt for identity-plane effects. Review new or modified authorization policies, downloadable ACLs, SGT/SXP mappings, endpoint group changes, guest accounts, sponsor approvals, certificate trust changes, admin accounts, external identity source changes, scheduled backups/exports, and log forwarding changes.

Remediation

Because the news item does not include fixed release numbers, the non-negotiable source of truth is the Cisco advisory for CVE-2026-76460 in the Cisco Security Advisory publication listing. Do not patch by rumor and do not assume a major ISE train is safe because it is "current." Match every node persona and version to the advisory's affected/fixed table, including hotfixes or interim patches if Cisco provides them.

Recommended remediation sequence:

1. Inventory precisely. Export ISE version, patch level, node persona, enabled services, API integrations, certificates, admin users, external identity sources, and interface reachability. Identify forgotten DR/backup PANs and lab nodes that still trust production credentials.
2. Apply Cisco fixed software immediately under emergency change control. If a fix is available for your train, stage it, snapshot VMs, verify backups, and patch PAN/MnT/PSN nodes in the order Cisco recommends. Validate replication and service health after each node rather than declaring victory after the first reboot.
3. If no fix is available for your version, treat compensating controls as mandatory. Enforce source allowlists at multiple layers, disable unneeded APIs, require mTLS at a gateway where possible, block dangerous methods for unapproved consumers, and move management to a dedicated PAW/jump path with MFA and session recording.
4. Verify the patch actually changed exposure. After upgrading, re-run authenticated and unauthenticated API probes from an approved test host and from a non-management network. Confirm unauthenticated requests fail consistently and that management routes are not answerable from user or Internet segments.
5. Reissue trust material if exposure was material. Where unauthenticated access was possible or observed, rotate admin/API credentials, service accounts, certificates, shared secrets, guest/sponsor credentials at scale if needed, and any automation tokens. Invalidate active sessions after rotation.
6. Audit configuration drift against a known-good backup. Compare authorization policy, network device definitions, SGT/SXP, TACACS command sets, certificate trust stores, syslog destinations, admin roles, external identity sources, and scheduled exports. Do not diff only what is easy; diff what changes access decisions.
7. Add permanent detection, not a one-week alert. Keep the successful-without-auth API rule, high-risk write operation rule, and failed-then-success rule in production with a tuned allowlist. Pipe ISE MnT/admin audit logs to the SIEM with retention aligned to IR needs.
8. Monitor KEV and vendor updates. Check CISA KEV and Cisco daily until patched and confirmed. If exploitation is confirmed or your telemetry shows suspect access, move from vulnerability management to incident response: preserve evidence, scope integrations, rotate broadly, and consider controlled credential invalidation across dependent network devices.

Executive takeaway: a CVSS 10 API authentication bypass in ISE is an identity control-plane emergency. The fastest risk reducer is not waiting for perfect root-cause detail; it is cutting reachability, proving unauthenticated requests fail, hunting for successful API activity that lacks normal auth context, and patching to the Cisco-confirmed fixed release as soon as it is available.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub