Cisco patches 21 ISE flaws, one exploited
Cisco fixed 21 vulnerabilities in Identity Services Engine and ISE-PIC, including a CVSS 10.0 auth-bypass (CVE-2026-76460) that is being actively exploited to gain root access.
Cisco has released fixes for 21 vulnerabilities affecting Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Thirteen of these are rated critical, and four — CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460 — carry the maximum CVSS score of 10.0. The flaw classes span REST API authentication bypass, command/OS command injection, SQL injection, insecure deserialization, path traversal, XXE, and insufficiently protected credentials. Four of the vulnerabilities can be exploited fully remotely without authentication.
Most notably, CVE-2026-76460 — an authentication bypass in an ISE/ISE-PIC API allowing an unauthenticated attacker to reach the affected system and subsequently execute commands with root privileges — is confirmed by Cisco to be actively exploited in the wild. CVE-2026-76423 similarly allows unauthenticated attackers to gain administrative access to ISE via the REST API. CVE-2026-20130 and CVE-2026-20192 are aggregate CVE identifiers Cisco created for a hardening release, each bundling multiple underlying CWE-class issues (insufficient input neutralization and improper access control, respectively) under a single score representing the highest-scoring sub-issue.
Successful exploitation across the vulnerability set can bypass authentication/authorization, expose or modify sensitive configuration and identity data, execute arbitrary code or commands as root, perform SQL injection, read arbitrary files, or disrupt system availability. Because attackers who gain root can erase or hide evidence of compromise, Cisco and NCSC-NL recommend checking external network and firewall logs for signs of abuse, and if compromise is suspected, reimaging affected ISE nodes and restoring configuration from backup. NCSC-NL urges prioritized patching of the critical-rated issues; Cisco has published an IoC for CVE-2026-76460 in its own advisory.
Mentioned in this report
Detection guidance
Unauthenticated REST API Access to Cisco ISE Administrative Functions
Detects unauthenticated HTTP requests to Cisco ISE REST API endpoints that return successful responses, indicating potential authentication bypass exploitation (CVE-2026-76460, CVE-2026-76423). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated REST API Access to Cisco ISE Administrative Functions
description: Detects HTTP requests to Cisco ISE REST API administrative endpoints
without authentication headers that receive successful responses (200-299), indicating
exploitation of authentication bypass vulnerabilities.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: cisco_ise
detection:
selection:
request_path|startswith:
- /admin/API/
- /api/v1/
- /api/v2/
request_path|contains:
- /config/
- /admin
- /command
http_status: lte:299
filter_authorized:
http_headers|contains: Authorization
condition: selection and not filter_authorized
falsepositives:
- Legitimate administrative API calls with missing authorization headers logged due
to proxy misconfiguration
- Load balancer health checks against ISE API endpoints
level: critical
id: 73dc85f9-3e4b-5b77-af70-6734f7e1402e
status: experimental
author: Vorant
Cisco ISE Suspicious Command Execution via REST API
Detects HTTP POST/PUT requests to Cisco ISE REST API with command execution or OS command parameters, indicating exploitation of command/OS command injection vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ISE Suspicious Command Execution via REST API
description: Detects HTTP requests to Cisco ISE REST API containing command execution
parameters or OS command injection payloads in the request body.
tags:
- attack.execution
- attack.t1059
logsource:
category: proxy
product: cisco_ise
detection:
selection:
request_path|startswith:
- /admin/API/
- /api/v1/
- /api/v2/
http_method:
- POST
- PUT
request_body|contains:
- cmd=
- command=
- exec
- /bin/
- sh -c
- bash -c
filter_legitimate_config:
request_body|contains: configVersion
condition: selection and not filter_legitimate_config
falsepositives:
- Legitimate ISE administrative tools making configuration API calls
- Cisco ISE backup/restore operations via API
level: high
id: 482086ea-5183-5b11-b9bc-405e7fe348fd
status: experimental
author: Vorant
Cisco ISE Suspicious File Access or Log Manipulation via REST API
Detects HTTP requests to Cisco ISE REST API indicating file read, write, or deletion operations that may signal data exfiltration, file manipulation, or log tampering following successful exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ISE Suspicious File Access or Log Manipulation via REST API
description: Detects HTTP requests to Cisco ISE REST API with file path parameters
or log access indicators, suggesting potential indicator removal or data exfiltration
post-exploitation.
tags:
- attack.defense-evasion
- attack.t1070
logsource:
category: proxy
product: cisco_ise
detection:
selection:
request_path|startswith:
- /admin/API/
- /api/v1/
- /api/v2/
request_body|contains:
- /var/log/
- catalina.log
- syslog
- auditlog
- /opt/
- rm -f
- delete
filter_legitimate_logging:
request_body|contains: logLevel
condition: selection and not filter_legitimate_logging
falsepositives:
- ISE administrative dashboards accessing logs for troubleshooting
- Legitimate log rotation or archive operations triggered via API
level: medium
id: b28bba6c-1b1a-5599-9fe6-f853cdc4d211
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0382.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free