Cisco has alerted customers to a second actively exploited, unpatched vulnerability in as many days — this time a maximum-severity flaw affecting Cisco Identity Services Engine (ISE), reported as CVE-2026-76460 per the source reporting. This is not an isolated event. ISE has now been hit with three actively exploited vulnerabilities since June 2025, following the CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337 exploitation campaign that CISA flagged last year. That pattern tells us something important: threat actors have mapped ISE's attack surface thoroughly and are prioritizing it as an initial-access vector.
If you run ISE — and if you're a mid-to-large enterprise doing 802.1X, NAC, or TACACS+ device administration, you almost certainly do — this is a drop-everything event. ISE sits at the policy enforcement point for your entire network. It authenticates users and devices, issues downloadable ACLs, integrates with Active Directory, and in many deployments holds credentials or certificates that unlock everything downstream. A compromise of ISE is not a compromise of an appliance; it is a compromise of your network's trust fabric.
No patch is available at time of writing. That makes your compensating controls, exposure reduction, and detection posture the entire ballgame until Cisco ships a fix.
Technical Analysis
What we know:
- Affected product: Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) deployments.
- Severity: Maximum-severity rating (CVSS 9.8–10.0 territory based on Cisco's "maximum-severity" classification language), consistent with the unauthenticated remote code execution class of bugs that plagued ISE throughout 2025.
- Patch status: Unpatched. Cisco has published an advisory acknowledging active exploitation but no fixed software release is available yet.
- Exploitation status: Confirmed in-the-wild exploitation. Expect CISA Known Exploited Vulnerabilities (KEV) catalog inclusion imminently, as happened with CVE-2025-20337 within days of disclosure. Federal civilian agencies will likely face a Binding Operational Directive remediation deadline; private-sector defenders should treat the KEV clock as theirs too.
Why ISE keeps getting burned: The 2025 ISE vulnerabilities (CVE-2025-20281, CVE-2025-20282, CVE-2025-20337) all shared a common anatomy: unauthenticated attackers sending crafted requests to exposed API or management interfaces, achieving remote code execution as root on the underlying Linux-based appliance. Attackers exploited a deserialization/input-validation weakness in a web-facing component, dropped webshells, and used the ISE node as a pivot point into internal networks. Post-exploitation tradecraft observed in the 2025 campaign included credential harvesting from ISE's AD integration, webshell deployment under the Tomcat application directories, and tampering with ISE's logging services to suppress evidence.
Defenders should assume CVE-2026-76460 follows a similar exploitation model until Cisco publishes full technical details: a remotely reachable service on the ISE Policy Administration Node (PAN) or Policy Service Node (PSN) persona accepting malicious input without authentication.
Exposure reality check: ISE management interfaces should never be internet-facing — yet internet-scanning data consistently shows hundreds of ISE portals and admin interfaces exposed, often mislabeled as "guest portals." Run a Shodan/Censys query against your own ASN today.
Detection & Response
Because there is no patch, detection engineering is your primary defense. The rules below target the post-exploitation behaviors consistent with the ISE exploitation tradecraft observed since mid-2025: webshell drops in ISE application directories, the ISE/Tomcat process spawning unexpected child shells, and anomalous inbound requests to ISE administrative endpoints.
Sigma Rules
---
title: Cisco ISE Tomcat Process Spawning Suspicious Child Shell
id: 3b8f4a21-9c6d-4e5f-b7a2-1d0e9f8c6a4b
status: experimental
description: Detects the ISE web application server (Tomcat/java) spawning shell or command interpreter processes, consistent with webshell execution following exploitation of Cisco ISE vulnerabilities including CVE-2026-76460 and CVE-2025-20337.
references:
- https://cyberscoop.com/cisco-ise-zero-day-cve-2026-76460/
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentCommandLine|contains:
- 'tomcat'
- '/opt/CSCOcpm'
- 'cisco-ise'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/python'
- '/perl'
- '/curl'
- '/wget'
condition: selection_parent and selection_child
falsepositives:
- ISE backup/restore operations and patch scripts may invoke shells from java-adjacent processes; baseline during maintenance windows
level: high
---
title: Webshell File Creation in Cisco ISE Web Application Directories
id: 7c1e9d54-2f8a-4b3c-a6d1-5e0b7c4f9a2d
status: experimental
description: Detects creation of script files (JSP, WAR-adjacent artifacts) in Cisco ISE Tomcat webapp directories, a hallmark of post-exploitation webshell deployment observed in the 2025 ISE exploitation campaign.
references:
- https://cyberscoop.com/cisco-ise-zero-day-cve-2026-76460/
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: linux
detection:
selection_path:
TargetFilename|contains:
- '/opt/CSCOcpm/tomcat/webapps/'
- '/opt/CSCOcpm/portal/'
selection_ext:
TargetFilename|endswith:
- '.jsp'
- '.jspx'
- '.war'
condition: selection_path and selection_ext
falsepositives:
- Legitimate ISE hotfix or patch installation; correlate against change windows and Cisco TAC activity
level: critical
KQL (Microsoft Sentinel / Defender)
ISE ships syslog natively; ingest it into Sentinel via the Syslog or CommonSecurityLog (CEF) connector and hunt for reconnaissance and exploit attempts against ISE management and portal endpoints, plus process anomalies forwarded from the appliance.
// Hunt: anomalous requests to Cisco ISE admin/API surfaces and ISE-generated suspicious process events
// Scope: Syslog + CEF ingestion from ISE nodes; adjust DeviceVendor strings to your connector output
let lookback = 14d;
let ise_hosts = dynamic(["ise-pan", "ise-psn"]); // extend with your ISE node hostnames
union isfuzzy=true
(Syslog
| where TimeGenerated >= ago(lookback)
| where Computer has_any (ise_hosts) or HostIP has "ise"
| where SyslogMessage has_any ("webshell", ".jsp", "cmd=", "/bin/sh", "/bin/bash", "wget ", "curl ")
and SyslogMessage has_any ("tomcat", "CSCOcpm", "portal")
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage, SeverityLevel),
(CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where DeviceVendor =~ "Cisco"
| where DeviceProduct has "ISE" or DeviceHostName has "ise"
| where RequestURL has_any ("/admin/", "/ers/", "/api/", "/portal/")
and (RequestURL has_any ("%2e", "..%2f", ".jsp", "cmd=", "exec", "${") or HttpUserAgent has_any ("curl", "python-requests", "sqlmap", "nuclei"))
| project TimeGenerated, SourceIP, DestinationHostName, RequestURL, RequestMethod, HttpUserAgent, DeviceAction)
| sort by TimeGenerated desc
Velociraptor VQL
If you can deploy a Velociraptor client (or run a standalone collector) on ISE-adjacent Linux jump boxes, or are collecting from ISE via SSH-driven artifact collection in your DFIR workflow, hunt for the process-execution and network-connection fingerprints of a compromised node:
-- Hunt Cisco ISE node for webshell-spawned processes and unexpected outbound connections
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Ppid IN (SELECT Pid FROM pslist() WHERE CommandLine =~ 'tomcat|CSCOcpm|java'))
AND Name =~ '^(sh|bash|dash|python|perl|curl|wget|nc|ncat)$'
-- Identify ISE processes holding unexpected outbound connections (C2 or data exfil)
SELECT Pid, Name, Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort,
Status, CommandLine
FROM netstat()
WHERE Name =~ 'java|tomcat|sh|bash|python'
AND Raddr.IP != ''
AND NOT (Raddr.IP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)')
Verification & Hardening Script
There is no patch to deploy, so your operational tasks are: enumerate your ISE deployment, verify personas and versions, confirm whether management interfaces are exposed, and lock down access. Run the following against your ISE CLI (SSH as admin):
#!/bin/bash
# Cisco ISE CVE-2026-76460 exposure triage — run on each ISE node via SSH
# Collects version/persona data and flags risky service exposure for the SOC
ISE_NODES="ise-pan-01.corp.local ise-psn-01.corp.local ise-psn-02.corp.local" # EDIT: your node FQDNs
ADMIN_NETS="10.20.30.0/24" # EDIT: networks permitted to reach ISE admin (TCP/443 admin UI, TCP/22)
REPORT="ise_triage_$(date +%Y%m%d_%H%M).txt"
for NODE in $ISE_NODES; do
echo "================ $NODE ================" | tee -a "$REPORT"
# Version & patch level — compare against Cisco advisory fixed-version table when published
ssh admin@$NODE "show version" 2>/dev/null | tee -a "$REPORT"
# Node personas — standalone/PAN nodes carry the management attack surface
ssh admin@$NODE "show nodes" 2>/dev/null | tee -a "$REPORT"
# Listening services — flag anything beyond expected ISE ports
ssh admin@$NODE "show tech" 2>/dev/null | grep -iE "LISTEN|tcp.*0.0.0.0" | head -40 | tee -a "$REPORT"
# Application service status — unexpected 'running' services = investigate
ssh admin@$NODE "show application status ise" 2>/dev/null | tee -a "$REPORT"
done
echo ""
echo "[!] MANUAL CHECKS REQUIRED:" | tee -a "$REPORT"
echo " 1. Confirm ISE admin UI (TCP/443), SSH (TCP/22), and ERS API (TCP/9060) are ACL-restricted to: $ADMIN_NETS" | tee -a "$REPORT"
echo " 2. Verify NO ISE interface is reachable from the internet (check edge NAT + Shodan for your ASN)" | tee -a "$REPORT"
echo " 3. Review ISE admin logins (Operations > Reports > Audit) for unrecognized source IPs in last 14 days" | tee -a "$REPORT"
echo " 4. Confirm syslog forwarding to SIEM is healthy on every node (Administration > Logging > Remote Logging Targets)" | tee -a "$REPORT"
echo " 5. Snapshot/backup each node NOW for forensic preservation before any remediation" | tee -a "$REPORT"
Remediation
1. Monitor Cisco's advisory channel and patch the moment a fixed release drops. Cisco's security advisories portal (https://sec.cloudapps.cisco.com/security/center/publicationListing.x) and the Cisco Security Advisory page for ISE are your authoritative sources. Given active exploitation, Cisco typically expedites either a hotfix or a full maintenance release — for the 2025 ISE bugs, fixed releases arrived as ISE 3.3 Patch 7, 3.4 Patch 3, and equivalent trains. Do not assume your train is safe; map your exact version/patch against the advisory's affected-versions table when published.
2. Apply Cisco's interim mitigations immediately. For prior unauthenticated ISE RCEs, Cisco's documented workaround was to restrict or disable access to the affected API/management endpoints and ensure management-plane interfaces are reachable only from trusted administrative networks. Until the CVE-2026-76460 advisory publishes specific guidance, apply the conservative baseline:
- Place the ISE admin UI (TCP/443), SSH (TCP/22), and ERS/OpenAPI interfaces (TCP/9060, 9061) behind strict ACLs permitting only your SOC/admin jump hosts.
- If ERS/API access is not operationally required, disable it (Administration > Settings > API Settings).
- Confirm guest/sponsor/hotspot portals are the only ISE interfaces reachable from untrusted segments — and ideally front them with a WAF.
3. Rotate credentials on any node you cannot confidently clear. ISE integrates with AD via machine accounts and often stores bind credentials for LDAP, plus certificates for EAP and pxGrid. If your triage shows suspicious logins, unexpected files, or process anomalies, treat the node as compromised: rebuild from known-good media, rotate the AD join account, LDAP bind accounts, TACACS+/RADIUS shared secrets, and any certificates issued to the node.
4. Hunt retroactively. The 2025 campaign demonstrated dwell time measured in weeks before disclosure. Run the KQL and Sigma content above against at least 30 days of retained ISE syslog. Look specifically for admin logins from non-admin subnets, portal-URL access with encoded traversal strings, and gaps in syslog forwarding (attackers tampered with ISE logging in the 2025 intrusions).
5. Prepare for CISA KEV action. Based on precedent, CVE-2026-76460 will enter the KEV catalog with a short federal remediation window (historically 3–7 days for maximum-severity, actively exploited network-edge flaws). Even if you're not BOD-bound, align your SLA: emergency-change approval for the patch within 24 hours of release, with interim ACL mitigations in place today.
6. Reassess ISE architecture long-term. Three exploited CVEs in under a year is a signal, not bad luck. If your ISE PAN is reachable from broad internal subnets "for convenience," that convenience is now your largest single point of failure. Move management to a dedicated VRF/management VLAN, enforce MFA for ISE admin accounts via external identity store integration, and evaluate whether portal personas can be isolated onto dedicated PSNs.
The pattern here is unmistakable: network-edge identity and access appliances — ISE, Ivanti, PAN-OS, Fortinet — are the front line of 2025–2026 intrusion campaigns. Your edge appliances deserve the same detection engineering, telemetry forwarding, and patch-sla rigor as your endpoints. Treat them like it.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.