Nov 2, 2026

Cisco ISE Authentication Bypass (CVE-2026-76460): Exploited in September, on Our Tracker Six Weeks Later

CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco ISE and ISE-PIC, already under attack when Cisco shipped fixes on September 16. The Live Exploit Tracker first recorded it on October 28, five days after a public Nuclei check appeared, and lists 311 unique IP addresses since. Check for compromise, then patch.

You can track the CVE here.

CVE-2026-76460 at a glance

Affected	Cisco ISE and ISE Passive Identity Connector (ISE-PIC), in any configuration, on releases before the fixes below. Release 3.0 is out of maintenance and has no fix.
Fixed in	3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4 (Cisco advisory, September 16, 2026)
Vulnerability class	Insufficient authentication on an API endpoint (CWE-648)
Severity	CVSS 3.1: 10.0 Critical
Authentication required	None
Public exploit	A detection check. The Nuclei template, merged October 23, 2026, reads the active-session list with a made-up cookie. As of November 2, we found no public code reaching the root access Cisco describes.
CISA KEV	Added September 16, 2026, with a September 19 deadline for US federal agencies and forensic triage required
CrowdSec detection rule live since	October 28, 2026 (generated October 24, the “Rule Released” date on the tracker)
First exploitation attempt observed	October 28, 2026, on the Live Exploit Tracker. That is the day the rule began tagging signals, so earlier requests are not counted. Cisco confirmed attacks on September 16.
Exploitation phase	Active Exploitation (Live Exploit Tracker, moved up from Limited Exploitation on October 29, 2026)
Observation window used here	Tagged signals from October 28 to November 1, 2026 (5 days); tracker addresses to November 2; CTI data over the 30 days to November 2.

CrowdSec exploitation timeline of CVE-2026-76460

Key findings

42 days between Cisco’s warning and the tracker’s first sighting: Cisco confirmed active exploitation on September 16, and the Live Exploit Tracker’s first-seen date for CVE-2026-76460 is October 28. Attacks began well before that date, so your log review has to reach further back.
A sweep from rented cloud: 540 signals between October 28 and November 1, peaking at 209 from 116 unique IP addresses on October 30. 63% came from Ireland, and 198 of the 270 addresses in CTI are Amazon addresses there.

What is Cisco ISE, and who is exposed to CVE-2026-76460?

Cisco Identity Services Engine (ISE) decides which people and devices may join a company network. Network and security teams run it, and its management interface belongs on an internal management network. Every deployment on an unfixed release is affected; those reachable from the internet are the ones scanners can find.

Why CVE-2026-76460 matters: Cisco says exploitation can give root command execution with no login. ISE holds the rules for network access, so root there means seeing who is connected and changing who gets in.

How does CVE-2026-76460 work?

Cisco says only that an API endpoint has insufficient authentication control, and its log guidance points at ise-kong, the gateway in front of ISE’s APIs. The Nuclei template shows the rest: a GET to /admin/API/mnt/Session/ActiveList returns 401 without a cookie, while an APPSESSIONID cookie holding random text makes a vulnerable server return the active-session list. The root cause in one sentence: the gateway accepts a session cookie nobody issued. The template stops at that proof, and no public source we found explains the path to root.

Found by Cisco during a support case, with no external reporter named. Public check by Roberto Nunes (0x_Akoko): template pull request
Vendor advisory: cisco-sa-ISE-ABP-VNSW7Tn5 · Cisco bug CSCww39530 · Fix: the releases above (closed source, no public commit)

A second maximum-severity ISE bypass, CVE-2026-76423, was patched the same week. It is not in CISA KEV as of the October 30 catalog.

What is the CrowdSec Network observing for CVE-2026-76460?

Between October 28 and November 1, 2026, the CrowdSec Network recorded 540 signals from machines reporting requests that match the CVE-2026-76460 exploitation pattern, detected by the CrowdSec rule live since October 28. That averages 108 per day, peaking at 209 from 116 unique IP addresses on October 30. The Live Exploit Tracker lists 311 unique IP addresses through November 2.

By day: 68 on Wednesday the 28th (a part day, since the rule went live that afternoon), 132, 209, then 60 and 71 over the weekend. The tracker moved CVE-2026-76460 from Limited to Active Exploitation on October 29.

The 42 days before that first sighting have a specific explanation: a rule needs a request to match, and the working request was not public.

September 16: Cisco publishes its advisory, naming no endpoint, and CISA adds the CVE to KEV.
September 18: Rescana notes that the “exact API endpoint and request shape are not published”.
September 21 and 29: The path surfaces in a honeypot project and a detection module in the Kittysploit framework. Neither sends the made-up cookie.
October 23: The Nuclei template is merged; the first public check we found that does. EPSS, flat at 14.0% since at least October 2, reaches 75.6% by October 25. Exploit code feeds that model, so it confirms the timing rather than any attack.
October 24: CrowdSec generates its rule from the template, the tracker’s “Rule Released” date.
October 28: The rule goes live after review, and the tracker records its first sighting.

Sources concentrate in rented cloud: 63% of signals came from Ireland, 16% from the Netherlands, 8% from the US, and 5% from Russia. CTI links 270 addresses to CVE-2026-76460 over the 30 days to November 2, and 198 of them are Amazon in Ireland, consistent with rented infrastructure rather than a residential botnet. Yandex Cloud in Russia adds 17, and research scanners from Hadrian, watchTowr, and CERT Polska appear too. Targets follow where CrowdSec is deployed: 40% of signals hit machines in France, 16% in Germany, 12% in Australia.

The part worth flagging is the weekend drop. Signals from Ireland fell from 165 on Friday, October 30, to 20 on Saturday. The tracker currently describes a cooling-off. It may just be the weekend, and this week’s numbers will settle it.

How do you protect Cisco ISE against CVE-2026-76460?

Patch. Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4, or migrate off 3.0 (Cisco advisory).

Preemptive blocking. Subscribe to the CrowdSec Intelligence Blocklists and enforce them on the firewall in front of ISE. 59 of the 270 addresses CTI links to CVE-2026-76460 (22%) are on at least one CrowdSec blocklist. That trims the sweep. It does not cover rotating cloud addresses or an attacker the network has never seen.

Stay proactive. Follow CVE-2026-76460 on the Live Exploit Tracker and query its sources in CrowdSec CTI.

Unsure where to start? Begin with our 3-minute introduction track.

Frequently asked questions about CVE-2026-76460

Is CVE-2026-76460 being exploited in the wild? Yes. Cisco and CISA confirmed exploitation on September 16, 2026. The CrowdSec Network recorded 540 signals matching the CVE-2026-76460 pattern between October 28 and November 1, and the Live Exploit Tracker lists 311 unique IP addresses through November 2. CrowdSec cannot confirm any succeeded.

Which versions of Cisco ISE are affected by CVE-2026-76460? ISE and ISE-PIC 3.1 before Patch 12, 3.2 before Patch 11, 3.3 before Patch 12, 3.4 before Patch 7, and 3.5 before Patch 4, in any configuration. Release 3.0 has no fix, so migrate.

Why does the Live Exploit Tracker show October 28 as first seen for CVE-2026-76460? October 28 is when CrowdSec’s rule went live and began tagging signals. It marks the start of our tagging, not the start of attacks, which Cisco and CISA confirmed on September 16. The rule was generated on October 24 from the Nuclei template merged on October 23.

Related CrowdSec threat alerts

Written by Matthieu M., Data Team Lead, CrowdSec. Published November 2, 2026.