CVE-2026-76447: Cisco ISE OCSP responder authentication bypass

CVE-2026-76447 · Severity: medium · CVSS 5.3 · Published 2026-09-16

Cisco Identity Services Engine (ISE) is a network access control platform used to manage device identities and enforce security policies across corporate networks. A vulnerability in its OCSP (certificate status checking) responder allows unauthenticated attackers to force a reload of security certificates and keys on demand, potentially disrupting certificate validation and authentication services.

Technologies: Cisco Identity Services Engine, Cisco ISE Passive Identity Connector. Vendors: Cisco.

Quick answers

Is CVE-2026-76447 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76447 being exploited in the wild.
How severe is CVE-2026-76447?
Medium severity, with a CVSS score of 5.3, published 16 September 2026.
Which products and versions are affected?
Cisco Identity Services Engine Multiple versions; see Cisco advisory for fixed versions; Cisco ISE Passive Identity Connector Multiple versions; see Cisco advisory for fixed versions.
Is there a fix for CVE-2026-76447?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76447 attacked?
It is attacked over the network.
Am I affected by CVE-2026-76447?
Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-76447 is a missing authentication vulnerability (CWE-306) in the OCSP responder component of Cisco ISE and ISE-PIC. An unauthenticated remote attacker can send a crafted request to the affected OCSP responder endpoint to trigger an administrative reload of certificate and key material. The attack requires network access to the OCSP responder but no authentication credentials or user interaction. Successful exploitation causes service disruption by forcing certificate reloads, potentially impacting certificate validation operations. Cisco has released software updates to address this vulnerability; no workarounds are available.

Affected products

  • Cisco Identity Services Engine Multiple versions; see Cisco advisory for fixed versions
  • Cisco ISE Passive Identity Connector Multiple versions; see Cisco advisory for fixed versions

Timeline

  • 2026-09-16: disclosed: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.