Quantum Secular Labs / Blog / Advisories

CVE-2026-76460: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

CVE-2026-76460 is rated critical with a CVSS v3.1 base score of 10.0 and affects Cisco Identity Services Engine. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-09-16, which means exploitation in the wild has been observed.

Vulnerability description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Severity breakdown

CVSS v3.1 10.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-648: Incorrect Use of Privileged APIs

The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

Affected products

  • Cisco Identity Services Engine: 3.1.0; 3.1.0 patch1; 3.1.0 patch10; 3.1.0 patch11; 3.1.0 patch2; 3.1.0 patch3; 3.1.0 patch4; 3.1.0 patch5; 3.1.0 patch6; 3.1.0 patch7; 3.1.0 patch8; 3.1.0 patch9
  • Cisco Identity Services Engine Passive Identity Connector: 3.1.0; 3.1.0 patch1; 3.1.0 patch10; 3.1.0 patch11; 3.1.0 patch2; 3.1.0 patch3; 3.1.0 patch4; 3.1.0 patch5; 3.1.0 patch6; 3.1.0 patch7; 3.1.0 patch8; 3.1.0 patch9

References