Cisco patches 21 ISE flaws, one exploited
Cisco fixed 21 vulnerabilities in Identity Services Engine and ISE-PIC, including a CVSS 10.0 auth-bypass (CVE-2026-76460) that is being actively exploited to gain root access.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 21 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-76460 as exploited in the wild.
Cisco has released fixes for 21 vulnerabilities affecting Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Thirteen of these are rated critical, and four — CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460 — carry the maximum CVSS score of 10.0. The flaw classes span REST API authentication bypass, command/OS command injection, SQL injection, insecure deserialization, path traversal, XXE, and insufficiently protected credentials. Four of the vulnerabilities can be exploited fully remotely without authentication.
Most notably, CVE-2026-76460 — an authentication bypass in an ISE/ISE-PIC API allowing an unauthenticated attacker to reach the affected system and subsequently execute commands with root privileges — is confirmed by Cisco to be actively exploited in the wild. CVE-2026-76423 similarly allows unauthenticated attackers to gain administrative access to ISE via the REST API. CVE-2026-20130 and CVE-2026-20192 are aggregate CVE identifiers Cisco created for a hardening release, each bundling multiple underlying CWE-class issues (insufficient input neutralization and improper access control, respectively) under a single score representing the highest-scoring sub-issue.
Successful exploitation across the vulnerability set can bypass authentication/authorization, expose or modify sensitive configuration and identity data, execute arbitrary code or commands as root, perform SQL injection, read arbitrary files, or disrupt system availability. Because attackers who gain root can erase or hide evidence of compromise, Cisco and NCSC-NL recommend checking external network and firewall logs for signs of abuse, and if compromise is suspected, reimaging affected ISE nodes and restoring configuration from backup. NCSC-NL urges prioritized patching of the critical-rated issues; Cisco has published an IoC for CVE-2026-76460 in its own advisory.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0382.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs