# CVE-2026-76460: A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

Source: https://junglewise.ai/threats/cve-2026-76460-cisco-identity-services-engine-incorrect-privileged-api-use  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-76460 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-09-16

Cisco Identity Services Engine (ISE) is a critical network access control and identity management system used by enterprises to manage authentication and authorization. A vulnerability in how ISE uses privileged APIs has been actively exploited by attackers to gain unauthorized access and control of affected systems. Federal agencies and all organizations are urged to prioritize patching this vulnerability immediately due to its active exploitation and high-risk nature.

Technologies: [Cisco Identity Services Engine](https://junglewise.ai/threats/technologies/identity-services-engine), [Cisco ISE Passive Identity Connector](https://junglewise.ai/threats/technologies/ise-passive-identity-connector). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76460 exploited in the wild?** Yes. CVE-2026-76460 is known to be exploited in the wild, first recorded on 16 September 2026. Treat it as urgent.

**How severe is CVE-2026-76460?** Critical severity, with a CVSS score of 10, published 16 September 2026.

**Which products and versions are affected?** Cisco Identity Services Engine.

**Is there a fix for CVE-2026-76460?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76460 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76460?** Check whether you run Cisco Identity Services Engine or Cisco ISE Passive Identity Connector. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-76460 is an incorrect use of privileged APIs vulnerability in Cisco Identity Services Engine. The vulnerability allows attackers to bypass authentication or authorization controls through improper use of privileged APIs, potentially granting total control of the affected system post-exploitation. The vulnerability is network-accessible and has evidence of active exploitation in the wild. No specific technical details on preconditions or exact attack vectors are provided in the advisory, but the impact is considered high-risk per CISA's KEV Catalog inclusion criteria. Organizations should apply available patches immediately as indicated by CISA's Binding Operational Directive 26-04.

## Affected products

- Cisco Identity Services Engine

## Timeline

- 2026-09-16: kev added: Added to CISA Known Exploited Vulnerabilities Catalog based on evidence of active exploitation

## References

- [https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog](https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog)

## Related threats

- [Cisco Identity Services Engine authorization bypass in management interface](https://junglewise.ai/threats/cve-2026-20183-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Identity Services Engine authorization bypass in certificate enrollment](https://junglewise.ai/threats/cve-2026-20241-a-vulnerability-in-the-authorization-mechanism-of-cisco-identity)
- [Cisco ISE SQL and HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76451-cisco-ise-sql-and-hql-injection-in-apis)
- [Cisco Identity Services Engine SQL and HQL injection](https://junglewise.ai/threats/cve-2026-76450-cisco-identity-services-engine-sql-and-hql-injection)
- [Cisco ISE SQL/HQL injection in APIs](https://junglewise.ai/threats/cve-2026-76449-cisco-ise-sql-hql-injection-in-apis)