Cisco ISE Incorrect Use of Privileged APIs (CVE-2026-76460)

let iseHosts = dynamic([]);
Syslog
| where Facility in ("local6", "local7", "auth", "authpriv") or ProcessName has_any ("ise", "cars", "prrt", "ADE")
| where SyslogMessage has_any ("ers/config", "/api/v1/", "/admin/API/", "openapi", "MnT", "internal")
| where SyslogMessage has_any ("privilege", "privileged", "escalat", "unauthorized", "forbidden bypass", "CSCadmin", "role=Super", "admin API")
| extend SrcIp = extract(@"(?:src|from|client)[=: ]+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| extend ApiPath = extract(@"((?:/ers|/api|/admin)[^\s\"]+)", 1, SyslogMessage)
| where isnotempty(ApiPath)
| summarize Count = count(), SamplePaths = make_set(ApiPath, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SrcIp
| where Count > 5 or SrcIp !in (iseHosts)
| order by Count desc

index=network sourcetype IN ("cisco:ise:syslog","cisco:ise","cisco:ise:admin") ("ers/config" OR "/api/v1/" OR "/admin/API/" OR "openapi" OR "MnT" OR "internal") ("privilege" OR "privileged" OR "escalat" OR "unauthorized" OR "role=Super" OR "admin API")
| rex field=_raw "(?:src|from|client)[=:\s]+(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| rex field=_raw "(?<api_path>(?:/ers|/api|/admin)[^\s\"]+)"
| where isnotnull(api_path)
| stats count as hits values(api_path) as api_paths min(_time) as first_seen max(_time) as last_seen by host src_ip
| where hits > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - hits

any where event.dataset : ("cisco.ise", "system.syslog") and
  (message : ("*ers/config*", "*/api/v1/*", "*/admin/API/*", "*openapi*", "*MnT*") and
   message : ("*privilege*", "*privileged*", "*escalat*", "*unauthorized*", "*role=Super*", "*admin API*"))

SELECT sourceip, destinationip, "Log Source", payload, DATEFORMAT(startTime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Cisco%ISE%' AND (payload ILIKE '%ers/config%' OR payload ILIKE '%/api/v1/%' OR payload ILIKE '%/admin/API/%' OR payload ILIKE '%openapi%' OR payload ILIKE '%MnT%') AND (payload ILIKE '%privilege%' OR payload ILIKE '%escalat%' OR payload ILIKE '%unauthorized%' OR payload ILIKE '%role=Super%') ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=*cisco*ise* ("ers/config" OR "/api/v1/" OR "/admin/API/" OR "openapi" OR "MnT") AND ("privilege" OR "privileged" OR "escalat" OR "unauthorized" OR "role=Super")
| parse regex "(?:src|from|client)[=:\s]+(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "(?<api_path>(?:/ers|/api|/admin)[^\s\"]+)" nodrop
| count as hits, values(api_path) by src_ip, _sourceHost
| where hits > 5
| sort by hits desc

rule cisco_ise_privileged_api_cve_2026_76460 {
  meta:
    author = "Argus"
    description = "Cisco ISE incorrect use of privileged APIs (CVE-2026-76460)"
    severity = "CRITICAL"
    cve = "CVE-2026-76460"
  events:
    $e.metadata.product_name = /ISE|Identity Services Engine/ nocase
    re.regex($e.metadata.description, `(?i)(ers/config|/api/v1/|/admin/API/|openapi|MnT)`)
    re.regex($e.metadata.description, `(?i)(privilege|privileged|escalat|unauthorized|role=Super)`)
    $host = $e.principal.hostname
  match:
    $host over 10m
  condition:
    $e
}

#event_simpleName=/.*/ | (Vendor=/(?i)cisco/ OR ProductName=/(?i)ISE|Identity Services Engine/)
| Message=/(?i)(ers\/config|\/api\/v1\/|\/admin\/API\/|openapi|MnT)/
| Message=/(?i)(privilege|privileged|escalat|unauthorized|role=Super)/
| groupBy([aid, ComputerName], function=count(as=hits))
| hits > 5
| sort(hits, order=desc)