The Gatekeeper Is the Door: One Unauthenticated API Call to Root on Cisco ISE (CVE-2026-76460)

The short version//

One API call. No login. Root. That's the threat model for CVE-2026-76460, an authentication bypass in a REST API endpoint of Cisco Identity Services Engine (advisory, published September 16, bug CSCww39530). A remote attacker who never had credentials sends one crafted request to the endpoint and bypasses the web-based management interface entirely. Cisco scores it CVSS 10.0 (AV:N/AC:L:PR:N/UI:N/S:C/C:H/I:H/A:H), classifies it as CWE-648, incorrect use of privileged APIs, and, in the section most people skip, tells you that successful exploitation can hand the attacker command execution with root privileges.

And it's not theoretical: Cisco PSIRT is aware of active exploitation, CISA added it to KEV on 2026-09-16 with a federal remediation due date of Saturday, 2026-09-19, and flagged it for forensic triage under BOD 26-04. Two days.

Why this one lands differently than a normal CVSS 10//

The vector's S:C (scope changed) is doing real work: the bug lives in one layer of ISE (an API endpoint with insufficient authentication control), but the payoff lands somewhere else entirely, on the management plane that runs the box. For non-Cisco people: you can picture it as a vending machine where tapping the return change slot skips to the cash drawer. The door nobody locks is the one that matters.

The scope of affected products is unforgiving because it's total: Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) are both vulnerable, regardless of device configuration. There is no "if you have X enabled" escape hatch in the advisory. And ISE is not a random appliance; it's the identity gatekeeper for enterprise and MSP networks: 802.1X, RADIUS, MAC authentication, guest portals. The box that decides who gets in to everything else just got a door of its own.

The fix (verified against the advisory's Fixed Software section)//

Per the advisory, first fixed releases:

ISE / ISE-PIC branch	First fixed release
3.1	3.1 Patch 12
3.2	3.2 Patch 11
3.3	3.3 Patch 12
3.4	3.4 Patch 7
3.5	3.5 Patch 4

(The advisory's table prints the last branch as "3.51"; there is no ISE 3.51, so read it as the 3.5 line.) Cisco's footnote: ISE 3.0 has reached End of Software Maintenance with no fix on that branch. If you're still on 3.0, you're not upgrading; you're migrating.

There are no workarounds. The only stopgap in the advisory is a mitigation: restrict management and control-plane traffic to the appliance with iACLs so only required sources can reach it. That shrinks the attack surface; it does not close the bug. Cisco's own framing ("workarounds and mitigations are temporary solutions until an upgrade") applies in full.

The forensics half of the story: grep ise-kong/access.log//

Cisco ships one concrete indicator to check, on every node in a distributed deployment:

admin#show logging application ise-kong/access.log | include dummyuser

(dummyuser is Cisco's example of what a suspicious username looks like; look for any unexpected entry, not just that string.) For older history, collect a support bundle with include debug logs selected and shared-key encryption; the rotated access logs live at ./ise/logs/apigateway/access.log..gz.

The catch is the same one as every root-level exploit: the attacker can clean house. Cisco's explicit guidance when malicious activity is suspected: re-image the affected nodes (restore from configuration backup if needed) and cross-check network and firewall logs outside the appliance for unexpected uploads to external IPs or downloads from suspicious ones. Root on ISE means the box that wrote your authentication logs may have been lying about them.

What to do tonight//

1. Check your ISE/ISE-PIC version against the fixed-release table above. If you're below the first fixed release on your branch, you're affected; configuration is irrelevant.
2. Upgrade to the first fixed release on your branch (or further if the September hardening release applies to it). On 3.0? Start planning the migration; that branch has no fix.
3. Grep ise-kong/access.log for suspicious usernames on every node, and read hits in context. A single odd entry is worth a forensics ticket.
4. Cross-check perimeter logs outside ISE for unexpected outbound uploads from it. Root can scrub the guest's room, but it usually forgets the lobby cameras.
5. If you suspect compromise: re-image nodes and restore config afterward; treat credentials that touched those boxes as exposed.
6. Apply iACLs to management traffic now if patching slips past Saturday. It's a mitigation, not a fix, but it's something.