CVE-2026-76460: Unauthenticated REST API Authentication Bypass in Cisco Identity Services Engine (ISE)

HERMES

HERMES THREAT SCORE & ZERO-TRUST NAC CATASTROPHIC RISK

Target: Cisco Identity Services Engine (ISE) & ISE-PIC — REST API Gateway & Policy Administration Node (PAN)

Confidence: 99%

100 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-76460 at the absolute maximum 10.0 (Critical), and Hermes corroborates an EXTREME threat score of 100. Cisco ISE serves as the centralized nervous system for enterprise Zero Trust architecture, 802.1X network access control (NAC), TACACS+/RADIUS authentication, and microsegmentation (TrustSec). Bypassing authentication on the REST API allows remote attackers to seize total control over network admission across all campus, branch, VPN, and data center switches.

HASS

HASS AGENTIC SEVERITY & PERIMETER AUTHENTICATION SUBVERSION

Target: Centralized Identity & Access Management, 802.1X NAC & Network Device Administration

Confidence: 96%

92 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 17 / 20

Tool Access 19 / 20

Privilege 20 / 15

Persistence 18 / 15

External Impact 18 / 15

Propagation 19 / 15

⚖️ Divergence & Operational Rationale

Compromising Cisco ISE provides adversaries with unconstrained lateral movement authority. The attacker can dynamically reconfigure network policies to bridge isolated security enclaves, extract Active Directory integration service account credentials, and silently authorize rogue devices onto mission-critical networks.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-76460: Unauthenticated REST API Authentication Bypass in Cisco Identity Services Engine (ISE)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTCisco Identity Services Engine (ISE)

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Cisco Identity Services Engine (ISE) documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Active In-The-Wild Exploitation: CISA KEV Catalog Addition

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-648: Incorrect Use of Privileged APIs / CWE-287: Improper Authentication. Disclosed by Cisco Systems on September 15, 2026 (Advisory: cisco-sa-ISE-ABP-VNSW7Tn5). Added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on September 16, 2026 under BOD 26-04 with immediate remediation mandated for federal and defense enterprise networks. Actively exploited by nation-state cyber espionage units to subvert zero-trust architectures.

Executive Summary

On September 15, 2026, Cisco published security advisory cisco-sa-ISE-ABP-VNSW7Tn5 disclosing CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw resides in the authentication filter pipeline of the appliance’s core REST API service.

An unauthenticated remote attacker can exploit this vulnerability by transmitting a specially crafted HTTP request to exposed REST API endpoints (such as the External RESTful Services / ERS API on TCP port 9060 or port 443). Successful exploitation allows the attacker to bypass authentication controls entirely, achieving unconstrained administrative privileges on the Cisco ISE Policy Administration Node (PAN). Threat actors can create rogue SuperAdmin accounts, export Active Directory domain credentials used for identity federation, manipulate RADIUS/TACACS+ shared secrets, and alter network authorization profiles to grant unauthorized access to sensitive VLANs.

---

1. Technical Context & Affected Software Matrix

Cisco ISE operates as the central policy decision point (PDP) for enterprise networks, coordinating with switches, wireless LAN controllers, and VPN gateways (policy enforcement points / PEPs) to enforce network segmentation.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-76460	Cisco Advisory cisco-sa-ISE-ABP-VNSW7Tn5 / CISA KEV
Vulnerability Class	Authentication Bypass (CWE-648 / CWE-287)	Flaw in REST API request authentication and authorization filter
Affected Component	Cisco ISE REST API Gateway & ERS Service	Listening on TCP ports 443 and 9060
Trigger Mechanism	Crafted HTTP request with manipulated header/path sequence	Bypasses Java Spring security filter chain in API gateway
Authentication Required	None (PR:N)	Attacker sends raw HTTP/HTTPS requests without credentials
User Interaction	None (UI:N)	Direct machine-to-machine exploitation
Privileges Obtained	SuperAdmin / Complete System Compromise	Administrative API manipulation and OS shell access
CISA KEV Status	Listed (Added September 16, 2026)	Emergency federal directive compliance deadline
Affected Products	Cisco ISE (Physical & Virtual) & Cisco ISE-PIC	Detailed in Cisco ISE Software Intelligence
Affected Versions	3.1 (p1-p11), 3.2 (p1-p10), 3.3 (p1-p11), 3.4 (p1-p6), 3.5 (p1-p3)	All active production deployments prior to September 2026 patches
Remediated Releases	3.1.0 Patch 12, 3.2.0 Patch 11, 3.3.0 Patch 12, 3.4.0 Patch 7, 3.5.0 Patch 4	Official Cisco maintenance updates implementing strict token validation

---

2. Vulnerability Anatomy & Root Cause Analysis

The Flawed REST API Authentication Filter Chain

Cisco ISE exposes multiple REST API interfaces:

• External RESTful Services (ERS): Operating on port 9060 (or reverse-proxied over 443), used for programmatic automation of endpoints, internal users, network devices, and guest portals.
• OpenAPI / Cisco ISE Admin REST APIs: Operating on port 443 for administrative management.

Under the hood, ISE utilizes Apache Tomcat and the Java Spring Security framework to manage request authentication. Incoming requests pass through a security filter chain:

1. ChannelProcessingFilter
2. SecurityContextPersistenceFilter
3. AuthenticationFilter (verifying HTTP Basic Auth, Session Cookies, or Bearer Tokens)
4. FilterSecurityInterceptor (authorizing API RBAC permissions)

Prior to the September 2026 fix, a critical flaw existed in the interaction between the front-end reverse proxy (Nginx / Apache HTTPd) and the internal Tomcat servlet container:

1. Specific internal API wrapper paths contained logic intended to support local inter-process communication (IPC) between ISE deployment nodes (e.g., Policy Service Nodes syncing with the Primary PAN).
2. By manipulating URL path normalization sequences (e.g., URL-encoded semicolons %3b, nested paths, or custom HTTP routing headers like X-Forwarded-Server or X-ISE-Internal-Call), external requests could trick the front-end reverse proxy into misclassifying the request as an internal, trusted inter-node service call.
3. The internal Tomcat authentication filter accepted the forged internal context, completely skipping credential verification and instantiating an elevated SuperAdmin security context for the request.

POST /ers/v2/config/internaluser HTTP/1.1
Host: ise.internal.corp:9060
User-Agent: Mozilla/5.0
Content-Type: application/json
Accept: application/json
X-ISE-Internal-Call: true
Connection: close

{
  "InternalUser": {
    "name": "backdoor_admin",
    "password": "ComplexPassword2026!",
    "identityGroups": "SuperAdmin",
    "enabled": true
  }
}

Because the authentication filter bypassed validation, the request succeeded with HTTP 201 Created, instantly provisioning an administrative account without valid credentials.

---

3. Attack Flow & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker
    participant Proxy as ISE Front-End Proxy (Port 443/9060)
    participant AuthFilter as Spring Security Filter Chain
    participant Backend as ISE Policy Database & Core Services
    participant Network as Corporate Network (Switches / WLCs / VPN)

    Attacker->>Proxy: Send crafted REST API request with internal bypass header
    Proxy->>AuthFilter: Forward request to internal Tomcat container
    AuthFilter->>AuthFilter: Misidentifies request as trusted internal node IPC
    Note over AuthFilter: Skips password and token validation (CVE-2026-76460)
    AuthFilter->>Backend: Execute administrative API call (Create SuperAdmin / Alter Policy)
    Backend-->>Attacker: Return HTTP 201 Created (Full administrative control established)
    Attacker->>Backend: Export AD bind account passwords & RADIUS pre-shared keys
    Attacker->>Network: Reconfigure 802.1X authorization rules to admit rogue attacker laptops

---

4. Detection Engineering & Hunting Signatures

Suricata Signature (API Bypass)

alert http any any -> any [443,9060] (
  msg:"HERMES THREAT - Cisco ISE REST API Authentication Bypass Attempt (CVE-2026-76460)";
  flow:to_server,established;
  content:"/ers/v2/"; http_uri;
  pcre:"/(X-ISE-Internal-Call|X-Forwarded-Server|%3b|\.\.\/)/i";
  threshold:type limit, track by_src, count 1, seconds 60;
  reference:cve,2026-76460;
  reference:url,sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5;
  classtype:attempted-admin;
  sid:202676460; rev:1;
)

Cisco ISE Log Analysis (Splunk / KQL)

// KQL hunting query for unauthorized Cisco ISE administrative actions
CiscoISE_CL
| where TimeGenerated >= ago(7d)
| where LogMessage has_any ("Administrator created", "InternalUser", "Policy changed", "ErsAdmin")
| extend ClientIP = extract(@"from\s+(\d+\.\d+\.\d+\.\d+)", 1, LogMessage)
| extend AdminUser = extract(@"user\s+(\w+)", 1, LogMessage)
| where not(ipv4_is_private(ClientIP)) or ClientIP !in ("10.0.0.50", "10.0.0.51") // Whitelist jumpboxes
| project TimeGenerated, ClientIP, AdminUser, LogMessage

Linux Shell Audit on ISE Appliance

## Run as admin on Cisco ISE CLI / root bash shell
## Check for newly created internal administrators
echo "[+] Auditing Cisco ISE internal administrators..."
show running-config | grep -A 5 "username"

## Inspect Tomcat localhost access logs for requests on port 9060/443 without Auth headers
grep -E "POST|PUT|DELETE" /opt/CSCOcpm/logs/catalina.out | grep -v "Authorization"

---

5. Forensic Investigation & Incident Response Playbook

When investigating suspected exploitation of CVE-2026-76460:

1. Administrative Account Inventory Audit: Immediately review the ISE internal user database:
   • Navigate to Administration > System > Admin Access > Administrators > Admin Users.
   • Review creation timestamps and verify whether any admin accounts were provisioned outside of change management windows.
2. Access Log Inspection on ERS Gateway: Examine Apache/Tomcat access logs located under:

   /opt/CSCOcpm/logs/
   /opt/CSCOcpm/logs/ers-service.log
   /opt/CSCOcpm/logs/ise-admin-audit.log

   Look for POST or PUT calls to /ers/v2/config/ originating from untrusted IP addresses without prior authentication exchanges.
3. Audit of Network Authorization Policies: Verify whether authorization rules or downloadable ACLs (dACLs) were modified to permit unauthenticated MAC addresses or rogue devices onto corporate subnets:
   • Review Policy > Policy Sets > Authorization Policy.
4. Credential Exposure Assessment: Assume full exposure of all credentials stored within ISE:
   • Active Directory computer account machine secrets and domain join accounts.
   • Network Device Group (NDG) RADIUS and TACACS+ pre-shared keys (PSKs).
   • Certificate authorities and private keys stored on ISE nodes.

---

6. Remediation, Patching & Hardening

1. Apply Official Cisco Software Patches Immediately: Upgrade all Cisco ISE nodes across the deployment to the patched releases:

   • Cisco ISE 3.1: Upgrade to 3.1.0 Patch 12
   • Cisco ISE 3.2: Upgrade to 3.2.0 Patch 11
   • Cisco ISE 3.3: Upgrade to 3.3.0 Patch 12
   • Cisco ISE 3.4: Upgrade to 3.4.0 Patch 7
   • Cisco ISE 3.5: Upgrade to 3.5.0 Patch 4
   • Cisco ISE-PIC: Apply corresponding hotfixes.

2. Restrict Network Access to Management Interfaces: Block all access to TCP ports 9060 (ERS API) and 443 (Admin Portal) from general user networks, untrusted subnets, and the Internet. Enforce dedicated out-of-band management subnets or jump boxes.

3. Disable ERS Service if Not Required: If programmatic ERS automation is not actively utilized in your environment, disable it immediately:

   • Navigate to Administration > System > Settings > ERS Settings and select Disable ERS (Read/Write).

4. Rotate All Shared Infrastructure Secrets:

   • Rotate all RADIUS and TACACS+ pre-shared keys configured on every switch, router, firewall, and wireless controller.
   • Re-authenticate or rejoin Cisco ISE to the Active Directory domain to generate fresh machine passwords.

---

7. Related Intelligence & Attack Paths

Cisco ISE Component Intelligence Access vulnerability metrics, patch posture, and threat intelligence for Cisco ISE.

Cisco Secure Firewall Auth Bypass (CVE-2026-20079) Analyze similar authentication bypass patterns affecting Cisco perimeter appliances.

Active Directory Kerberos & NTLM Forensics Investigate post-compromise identity theft following directory credential dumping.