Detect Cisco ISE Incorrect Use of Privileged APIs (CVE-2026-76460) in Elastic Security
Detects exploitation attempts and indicators associated with CVE-2026-76460, a KEV-listed vulnerability in Cisco Identity Services Engine (ISE) stemming from incorrect use of privileged APIs (CWE-648). An attacker can invoke privileged internal API functions through improperly authorized code paths, potentially leading to privilege escalation, configuration tampering, or command execution on the ISE appliance. This detection surfaces anomalous access to ISE administrative/internal API endpoints, unexpected privileged operations initiated from low-privilege or unauthenticated sessions, and post-exploitation configuration changes visible in ISE application, admin audit, and API access logs.
MITRE ATT&CK
Elastic Detection Query
any where event.dataset : ("cisco.ise", "system.syslog") and
(message : ("*ers/config*", "*/api/v1/*", "*/admin/API/*", "*openapi*", "*MnT*") and
message : ("*privilege*", "*privileged*", "*escalat*", "*unauthorized*", "*role=Super*", "*admin API*"))Elastic EQL match on Cisco ISE syslog messages showing privileged/internal API access patterns tied to CVE-2026-76460.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrator ERS/OpenAPI automation
- Integration service accounts (pxGrid, DNA Center) using privileged APIs
- Authorized scanning of the ISE admin interface
Other platforms for CVE-2026-76460
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthorized ERS privileged API probe
Expected signal: ISE ERS access log and syslog entries showing a request to /ers/config/adminuser from the test source IP.
- Test 2OpenAPI internal endpoint enumeration
Expected signal: Multiple ISE syslog/API access entries for /api/v1/ and /admin/API/ paths in a short window from one source IP.
- Test 3Windows-based privileged API invocation attempt
Expected signal: ISE ERS access log entry for /ers/config/adminuser originating from the Windows test host IP.
References (4)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-76460
Response Playbook
Triage
- Confirm the source ISE appliance version against Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 and determine whether it is running a fixed release; if unpatched, treat as high priority given KEV listing.
- Identify the source IP(s) invoking privileged/internal API endpoints and correlate against your inventory of sanctioned automation, pxGrid, and DNA Center integration hosts.
- Review the specific API paths and operations invoked (e.g., ERS config writes, admin role changes) to determine whether privileged functions were reached from an unauthorized or low-privilege session.
- Check ISE admin audit logs for unexpected account creation, role elevation (role=Super/CSCadmin), or policy/config changes coincident with the API activity.
Containment
- Restrict access to the ISE administrative and API interfaces to a management ACL / jump-host allowlist and block untrusted source IPs at the network layer.
- Disable or rotate credentials for any ERS/OpenAPI service accounts that show anomalous privileged calls, and revoke suspicious admin sessions.
- Apply the Cisco fixed release for CVE-2026-76460 on an emergency change window per CISA BOD 26-04 timelines.
Evidence Collection
- Preserve ISE application server logs, admin audit logs, API access logs, and syslog covering the activity window before rotation or upgrade.
- Capture the full request/response payloads (from syslog/proxy/WAF in front of ISE) for the privileged API calls, including source IP, session token, and invoked endpoint.
- Export the current ISE configuration and admin account/role list for comparison against a known-good backup to identify tampering.
Escalation Criteria
- !Escalate to incident response if privileged API calls resulted in configuration changes, new/elevated admin accounts, or evidence of authentication policy tampering.
- !Escalate to leadership and report per CISA BOD 26-04 if the appliance is unpatched and internet-exposed or if exploitation is confirmed against a production identity control plane.
- !Escalate if the same source IP pivots to other network access control or identity infrastructure after touching ISE.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
ISE admin audit log entries (config changes, role modifications, account creation) - >
ISE ERS/OpenAPI access logs with source IP and invoked endpoint - >
Cisco ISE syslog (local6/local7) showing API and authorization events - >
ISE configuration backup / running config for tamper comparison
Tuning Guidance
Baseline the source IPs and service accounts that legitimately call ERS/OpenAPI privileged endpoints (provisioning tools, pxGrid, DNA Center) and add them to an allowlist. Raise the event-count threshold to match normal automation volume, and scope queries to your ISE appliance hostnames. Alert with higher fidelity when privileged API access originates from an IP outside the management ACL or is followed by admin role/config changes.
Hunting Queries
Hunts for ISE admin account creation or privilege elevation that may follow CVE-2026-76460 exploitation.
Syslog | where ProcessName has_any ("ise","cars","prrt") | where SyslogMessage has_any ("role=Super","CSCadmin","account created","AdminUser") | project TimeGenerated, Computer, SyslogMessage | order by TimeGenerated descindex=network sourcetype IN ("cisco:ise:syslog","cisco:ise:admin") ("role=Super" OR "CSCadmin" OR "account created" OR "AdminUser") | table _time host _raw | sort - _timeAtomic Red Team Tests
Simulate an attacker probing the ISE ERS privileged configuration API from an unsanctioned host to generate access-log telemetry.
Command
curl -sk -u probe:probe -H 'Accept: application/json' 'https://ise.lab.local:9060/ers/config/adminuser' -o /tmp/ise_probe_resp.jsonCleanup
rm -f /tmp/ise_probe_resp.jsonExpected Telemetry
ISE ERS access log and syslog entries showing a request to /ers/config/adminuser from the test source IP.
Expected Detection
KQL/SPL queries flag the /ers/config privileged path access from a non-allowlisted source IP.
Enumerate ISE OpenAPI/internal endpoints to mimic reconnaissance of privileged API functions.
Command
for p in /api/v1/system-config/adminuser /admin/API/mnt/Version /api/v1/policy; do curl -sk "https://ise.lab.local/$p" -o /dev/null -w '%{http_code} '$p'\n'; doneCleanup
trueExpected Telemetry
Multiple ISE syslog/API access entries for /api/v1/ and /admin/API/ paths in a short window from one source IP.
Expected Detection
Detection triggers on repeated privileged/internal API path access exceeding the event threshold.
From a Windows host, attempt to invoke an ISE privileged admin API method to simulate cross-platform exploitation attempts.
Command
powershell -NoProfile -Command "[Net.ServicePointManager]::ServerCertificateValidationCallback={$true}; Invoke-WebRequest -Uri 'https://ise.lab.local:9060/ers/config/adminuser' -Headers @{Accept='application/json'} -Credential (New-Object PSCredential('probe',(ConvertTo-SecureString 'probe' -AsPlainText -Force))) -UseBasicParsing | Out-Null"Cleanup
powershell -NoProfile -Command "Remove-Variable -Name * -ErrorAction SilentlyContinue"Expected Telemetry
ISE ERS access log entry for /ers/config/adminuser originating from the Windows test host IP.
Expected Detection
Detection surfaces the privileged ERS API access from a non-allowlisted Windows source.