{"id":12008,"date":"2026-09-17T08:53:52","date_gmt":"2026-09-17T14:53:52","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-101-critical-zero-day-in-cisco-ise-and-ise-pic-cve-2026-76460\/"},"modified":"2026-09-29T13:59:33","modified_gmt":"2026-09-29T19:59:33","slug":"alert-2026-101-critical-zero-day-in-cisco-ise-and-ise-pic-cve-2026-76460","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-101-critical-zero-day-in-cisco-ise-and-ise-pic-cve-2026-76460\/","title":{"rendered":"Alert 2026-101 Critical Zero-day in Cisco ISE and ISE-PIC \u2014 CVE\u20112026\u201176460"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n

The vulnerability affects Cisco ISE<\/strong> and Cisco ISE\u2011PIC<\/strong>, regardless of device configuration. Cisco has published fixes for the following supported branches:<\/p>\n\n

Product<\/strong><\/td>Affected Branch<\/strong><\/td>Minimum Fixed Version<\/strong><\/td><\/tr>
Cisco Identity Services Engine (ISE)<\/strong><\/td>3.1<\/td>3.1 Patch 12<\/td><\/tr>
Cisco Identity Services Engine (ISE)<\/strong><\/td>3.2<\/td>3.2 Patch 11<\/td><\/tr>
Cisco Identity Services Engine (ISE)<\/strong><\/td>3.3<\/td>3.3 Patch 12<\/td><\/tr>
Cisco Identity Services Engine (ISE)<\/strong><\/td>3.4<\/td>3.4 Patch 7<\/td><\/tr>
Cisco Identity Services Engine (ISE)<\/strong><\/td>3.5 \/ 3.5.3<\/td>3.5 Patch 4<\/td><\/tr>
Cisco ISE Passive Identity Connector (ISE\u2011PIC)<\/strong><\/td>Supported vulnerable versions<\/td>Apply the equivalent patch for the deployed branch<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

*Cisco ISE Software Release 3.0 has reached end of software maintenance<\/strong>, so it does not have a corrective update for this vulnerability. Teams remaining on that branch should plan an upgrade to a supported release as a priority.<\/p>\n\n

Description<\/h2>\n\n

A critical<\/strong> authentication bypass vulnerability has been published in Cisco Identity Services Engine (ISE<\/strong>) and Cisco ISE Passive Identity Connector (ISE\u2011PIC<\/strong>), identified as CVE\u20112026\u201176460<\/strong> with a CVSS 10.0<\/strong> score. It allows an unauthenticated remote attacker to send a specially crafted request to an affected API endpoint, bypass authentication on the administration web interface, and obtain unauthorized access to the device. Cisco confirmed that the vulnerability is being actively exploited.<\/strong><\/p>\n\n

Since ISE typically acts as a central component for network access control, authentication, and identity policies, a compromise can affect identity management, user and device access to the network, and the organization’s security posture. It is recommended to update all affected ISE\/ISE\u2011PIC nodes with maximum priority and perform a compromise review.<\/p>\n\n

Cisco PSIRT confirmed awareness of active exploitation in real environments, although it has not published details about the responsible actor, the exact attack method, or the affected organizations.<\/p>\n\n

Cisco recommends reviewing the ISE access.log file for suspicious usernames, in particular the dummyuser. In distributed deployment environments, the review must be performed on each node<\/strong> of ISE\/ISE\u2011PIC.bleepingcomputer+1<\/p>\n\n

Run the following command on each node:<\/p>\n\n

admin#show logging application ise-kong\/access.log | include dummyuser<\/p>\n\n

The presence of entries related to dummyuser in the output should be treated as an indicator of potential malicious activity<\/strong> and requires immediate investigation.<\/p>\n\n

Additionally, it is recommended to investigate:<\/p>\n\n