Quick answers
- Is CVE-2026-76460 exploited in the wild?
- Yes. CVE-2026-76460 is known to be exploited in the wild, first recorded on 16 September 2026. Treat it as urgent.
- How severe is CVE-2026-76460?
- Critical severity, with a CVSS score of 10, published 16 September 2026.
- Which products and versions are affected?
- Cisco Identity Services Engine.
- Is there a fix for CVE-2026-76460?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76460 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-76460?
- Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-76460 is an incorrect use of privileged APIs vulnerability in Cisco Identity Services Engine. The vulnerability allows attackers to bypass authentication or authorization controls through improper use of privileged APIs, potentially granting total control of the affected system post-exploitation. The vulnerability is network-accessible and has evidence of active exploitation in the wild. No specific technical details on preconditions or exact attack vectors are provided in the advisory, but the impact is considered high-risk per CISA's KEV Catalog inclusion criteria. Organizations should apply available patches immediately as indicated by CISA's Binding Operational Directive 26-04.
Affected products
- Cisco Identity Services Engine
Timeline
- 2026-09-16: kev added: Added to CISA Known Exploited Vulnerabilities Catalog based on evidence of active exploitation