CVE-2026-76460: Cisco ISE Privileged API Exploitation in the Wild — Detection and Remediation Guide

CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16, confirming what many of us in the IR community had been tracking quietly: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) are being actively exploited in the wild via an incorrect use of privileged APIs vulnerability. This is not a theoretical risk. Exploitation is confirmed, and the affected product sits at one of the most sensitive chokepoints in enterprise architecture — network access control and identity policy enforcement.

The flaw allows an unauthenticated, remote attacker to gain unauthorized access to an affected device by bypassing the web-based management interface entirely. In plain terms: an attacker who can reach your ISE admin plane over the network can potentially sidestep authentication controls and interact with privileged API functionality that should only be available to authenticated administrators. For an appliance that controls 802.1X policy, guest access, device profiling, and pxGrid integrations across your environment, that is a worst-case exposure scenario.

Federal Civilian Executive Branch agencies are bound by CISA's Binding Operational Directive (BOD) 26-04, which requires mitigations per vendor instructions and compliance with CISA's Forensics Triage Requirements. Private sector organizations should treat the KEV listing with the same urgency — KEV inclusion means exploitation is happening now, not eventually.

Technical Analysis

Affected Products

Consult the official Cisco Security Advisory for the definitive list of affected and fixed release trains. Cisco's advisory for this CVE is available via the Cisco Security Advisories portal and is cross-linked from the CISA KEV catalog entry.

Vulnerability Class and Attack Mechanics

The vulnerability is categorized as incorrect use of privileged APIs. From a defender's perspective, the attack chain looks like this:

1. Reconnaissance: The attacker identifies an internet-exposed or internally reachable ISE management plane. ISE admin services commonly listen on TCP/443 (admin portal) and TCP/9060 (ISE-PIC admin). Shodan/Censys exposure for ISE is well documented, and any node with the admin interface reachable from untrusted segments is a candidate target.
2. Interface bypass: Rather than authenticating through the web-based management UI, the attacker crafts requests directly against privileged API endpoints on the appliance. The vulnerable code path fails to enforce the same authorization and session validation applied to the web UI flow, meaning API calls that should require an authenticated administrative session can be invoked without one.
3. Unauthorized access: Successful exploitation grants the attacker access to privileged functionality on the device — potentially including configuration manipulation, credential stores (which in ISE can include AD join credentials, certificates, and RADIUS shared secrets), and a pivot point into the identity fabric of the enterprise.

Why ISE Compromise Is Disproportionately Dangerous

Having led IR engagements where NAC/AAA infrastructure was the initial beachhead, I can state plainly: an ISE compromise is not an appliance compromise — it is an identity-plane compromise. ISE holds:

• RADIUS/TACACS+ policy and shared secrets for every network device
• Active Directory integration credentials and machine trust relationships
• Certificate authority and trust material for EAP-TLS deployments
• pxGrid context shared with firewalls, SIEMs, and EDR platforms

An attacker with administrative-level control over ISE can weaken or disable 802.1X enforcement, authorize rogue devices onto protected VLANs, harvest directory credentials, and tamper with logging — all while the appliance itself continues to look "healthy" in dashboards.

Exploitation Status

• CISA KEV: Added 2026-09-16 — confirmed active exploitation
• Authentication required: None (unauthenticated, remote)
• Public PoC: Treat as weaponized; KEV listing implies working exploit capability in adversary hands

Detection & Response

Because exploitation bypasses the web management interface, traditional "failed login" alerting on the admin portal will not catch it. You need visibility into API-plane traffic, anomalous administrative sessions, configuration change telemetry, and unexpected account activity. ISE forwards extensive syslog — if you are not shipping ISE logs to your SIEM today, that is gap number one.

Sigma Rules

---
title: Cisco ISE Unauthenticated API Access Attempt
description: Detects direct requests to Cisco ISE privileged REST/ERS API endpoints from sources outside expected admin networks, consistent with CVE-2026-76460 exploitation which bypasses the web-based management interface.
id: 3f8a2c71-9d4e-4b6a-a1c5-7e2d9f0b8c31
status: experimental
author: Security Arsenal
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460
date: 2026/09/17
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: cisco
  service: ise
detection:
  selection_api:
    uri_path|contains:
      - '/ers/config/'
      - '/admin/API/'
      - '/api/v1/'
      - '/admin/rs/'
  selection_anomalous:
    http_status:
      - 200
      - 201
  condition: selection_api and selection_anomalous
falsepositives:
  - Legitimate ERS/MNT integrations (pxGrid, MDM sync) from known service accounts — whitelist by source IP and service account after validation
level: high
---
title: Cisco ISE Administrative Session From Unexpected Source
description: Detects successful administrative authentication or session establishment on Cisco ISE originating from IP addresses outside the designated management network — a hallmark of post-exploitation activity following CVE-2026-76460.
id: 6b1e4d92-2a7f-4c38-b9d4-5f3a8e1c6d27
status: experimental
author: Security Arsenal
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460
date: 2026/09/17
tags:
  - attack.persistence
  - attack.t1078
logsource:
  product: cisco
  service: ise
detection:
  selection:
    event_type|contains:
      - 'Admin-Login succeeded'
      - 'admin login success'
      - 'API operation succeeded'
  condition: selection
falsepositives:
  - Scheduled administrative work from bastion hosts — baseline and alert on deviations from the known admin source set
level: high
---
title: Cisco ISE New Local Administrator Account or Privilege Change
description: Detects creation of new administrator accounts or privilege modifications on Cisco ISE, a common persistence action after unauthenticated API-level compromise of CVE-2026-76460.
id: 9c4d7f15-8b3e-4a21-c6f9-2d8b5e4a7c93
status: experimental
author: Security Arsenal
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460
date: 2026/09/17
tags:
  - attack.persistence
  - attack.t1136
logsource:
  product: cisco
  service: ise
detection:
  selection:
    message|contains:
      - 'Admin user added'
      - 'administrator account created'
      - 'role changed'
      - 'privilege'
      - 'Admin-User'
  condition: selection
falsepositives:
  - Legitimate onboarding of new administrators — correlate with change tickets
level: critical

KQL — Microsoft Sentinel Hunt (ISE via CEF/Syslog ingestion)

// Hunt for anomalous API-plane and admin-plane activity on Cisco ISE nodes
// Assumes ISE syslog is ingested via CEF (CommonSecurityLog) or Syslog connector
let AdminSubnets = dynamic(["10.10.5.0/24", "192.168.100.0/24"]); // REPLACE with your mgmt subnets
let Lookback = 14d;
union CommonSecurityLog, Syslog
| where TimeGenerated > ago(Lookback)
| where Computer has_any ("ise", "pic") or SourceHostName has_any ("ise", "pic")
| extend RawMsg = coalesce(Message, SyslogMessage)
| where RawMsg has_any ("Admin-Login succeeded", "API operation succeeded", "Admin user added", "administrator account created", "/ers/config/", "/admin/API/")
| extend SrcIP = coalesce(SourceIP, SourceHostIP)
| where not (ipv4_is_in_any_range(SrcIP, "10.10.5.0/24", "192.168.100.0/24")) // REPLACE with mgmt ranges
| project TimeGenerated, Computer, SrcIP, RawMsg, Facility, SeverityLevel
| sort by TimeGenerated desc

Velociraptor VQL — Endpoint Hunt for Admin-Plane Pivot Activity

If ISE is compromised, expect the attacker to interact with it from a workstation or jump host. This artifact hunts endpoints for unusual outbound connections to ISE management ports outside of known admin hosts.

-- Hunt for unexpected client connections to Cisco ISE management interfaces
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       netstat().RemoteIP AS RemoteIP,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS ConnStatus
FROM netstat()
WHERE RemotePort IN (443, 9060, 9061)
  AND ConnStatus =~ 'ESTABLISHED'
  AND NOT Name =~ '(?i)(chrome|firefox|msedge|firefox)\\.exe'

Follow this with pslist() on any host showing non-browser established sessions to ISE admin ports — automation tools, scripts, or reverse shells hitting 443/9060 against ISE are immediately suspicious unless tied to a documented integration.

Remediation Verification Script (Bash)

Run from a management host with CLI/API access to your ISE nodes to inventory versions and confirm the admin interface is not exposed.

#!/bin/bash
# CVE-2026-76460 — Cisco ISE exposure and version verification
# Requires: SSH access to ISE CLI (admin shell) and network reachability

NODES="ise-pan1.corp.local ise-pan2.corp.local ise-pic1.corp.local"
REPORT="ise_cve_2026_76460_audit_$(date +%F).log"

echo "=== CVE-2026-76460 ISE Audit — $(date) ===" | tee "$REPORT"

for NODE in $NODES; do
  echo "--- $NODE ---" | tee -a "$REPORT"

  # Pull software version and installed patches via CLI
  ssh admin@"$NODE" "show version" 2>/dev/null | tee -a "$REPORT"

  # Check whether admin portal is listening on unexpected interfaces
  ssh admin@"$NODE" "show interface | include Gigabit|Internet" 2>/dev/null | tee -a "$REPORT"
done

# External exposure check — run from outside the trusted network
for NODE in $NODES; do
  for PORT in 443 9060 9061; do
    if nc -z -w3 "$(getent hosts "$NODE" | awk '{print $1}')" "$PORT" 2>/dev/null; then
      echo "[EXPOSED] $NODE:$PORT reachable — verify ACL restrictions" | tee -a "$REPORT"
    fi
  done
done

echo "Cross-reference 'show version' output against the fixed releases in the Cisco advisory for CVE-2026-76460." | tee -a "$REPORT"

Remediation

Act in this order. Do not wait for a maintenance window to do step 1 — it is a compensating control you can execute today.

1. Isolate the management plane immediately. Enforce ACLs/security groups so the ISE admin interface and API endpoints are reachable only from dedicated management subnets and jump hosts. If any ISE node has its admin plane reachable from the internet or general user segments, treat that node as potentially compromised and escalate to step 4 in parallel.
2. Apply Cisco's fix per the vendor advisory. Consult the Cisco Security Advisory for CVE-2026-76460 (linked from the CISA KEV entry and the Cisco Security Advisory portal) for the exact fixed release for your train (ISE 3.x line). Upgrade the Primary Administration Node first, then distributed personas per Cisco's documented order. Do not skip ISE-PIC nodes — they are explicitly named in the CVE.
3. Meet the KEV deadline. FCEB agencies must remediate by the due date listed in the KEV catalog under BOD 26-04 and comply with CISA's Forensics Triage Requirements (preserve memory/disk images and relevant logs before patching where exploitation is suspected). All other organizations should adopt the same deadline as an internal SLA — KEV timelines are calibrated to observed adversary tempo.
4. Hunt before and after patching. Because exploitation bypasses the web UI, patching alone does not evict an attacker. Run the detections above across at least the last 30 days of ISE syslog. Review admin accounts, API client definitions, ERS/MNT integration configs, and scheduled tasks for unauthorized additions.
5. Rotate credentials on any node with indicators or unexplained API-plane traffic: local admin passwords, AD join account, RADIUS/TACACS+ shared secrets, ERS API client credentials, and certificates if private key compromise cannot be ruled out.
6. Enable and centralize ISE logging. Ship Administration, AAA Audit, and Operations audit categories to your SIEM over syslog/TLS. If your ISE logging currently lives only on the box, you are flying blind for exactly this class of attack.
7. Reassess persona placement. Administration personas should never share an interface with Policy Service personas in sensitive environments, and should sit behind a dedicated management VRF. This incident is the business case.

If you find evidence of exploitation — unexplained admin sessions, API operations from foreign IPs, or configuration drift — treat it as an identity-plane incident: assume directory-adjacent credential exposure and scope accordingly. This is precisely the class of engagement where experienced DFIR support pays for itself.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub