Cisco ISE and ISE-PIC Privileged API Flaw Actively Exploited, Added to CISA KEV

What happened

Cisco disclosed a vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) involving incorrect use of privileged APIs, tracked as CVE-2026-76460. According to Cisco's advisory, the flaw could let an unauthenticated, remote attacker bypass the web-based management interface and gain unauthorized access to the affected device. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating it is being actively exploited in the wild; no CVSS score has been published in the source item reviewed here.

Why it matters

Cisco ISE is widely deployed as a network access control and identity policy engine, often sitting in a highly privileged position on enterprise networks — governing 802.1X authentication, device posture, and segmentation policy. An unauthenticated bypass of its management interface is significant: successful exploitation could give an attacker administrative-level control over network access decisions without needing valid credentials first. Organizations running ISE or ISE-PIC for NAC, guest access, or identity-based segmentation should treat this as high priority, particularly if the management interface is reachable from untrusted or broader internal network segments.

What defenders should do now

• Identify all Cisco ISE and ISE-PIC instances in your environment and confirm whether their web-based management interfaces are exposed beyond a tightly restricted management network.
• Check Cisco's advisory for affected software versions and apply vendor-supplied fixes or mitigations as soon as they are available and validated in your environment.
• Until patched, restrict access to the ISE administrative interface to trusted management VLANs/jump hosts only, and review firewall/ACL rules governing access to it.
• Hunt for anomalous authentication events, unexpected admin API calls, or unusual configuration changes on ISE nodes, especially any activity inconsistent with known administrator sessions.
• Review ISE logs and any available API/audit logs for signs of privileged actions taken without a corresponding legitimate login.

Developing intel

This is a same-day KEV addition and the full technical details — including affected version ranges, patch availability, and exploitation specifics — are still emerging. This post will be revisited as more information becomes available. For the authoritative details, see Cisco's security advisory.