When the Management Plane Becomes the Door: Cisco ISE Auth Bypass Hits CVSS 10.0 as Federal Deadline Expires

Analysis

CVE-2026-76460 is a CVSS 10.0 authentication bypass in the Cisco ISE management API with root-level access and log-wiping capability. The CISA federal compliance deadline expires today.

Mechanism of the Authentication Bypass

CVE-2026-76460 is a critical vulnerability within the Cisco Identity Services Engine (ISE) management interface, assigned a CVSS score of 10.0. The flaw, categorized as CWE-648, arises from the incorrect use of privileged APIs. According to the Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5, an unauthenticated remote attacker can transmit a crafted request to a specific API endpoint that lacks sufficient authentication controls. Successful exploitation grants the attacker command execution with root privileges on the affected system. This vulnerability impacts Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC) releases 3.0 through 3.5.

Exploitation Context and Federal Deadlines

The Cisco Product Security Incident Response Team (PSIRT) has confirmed…