~/news/2026-09-16-cisco-ise-api-auth-bypass.md

What happened. Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on 2026-09-16 for CVE-2026-76460, a CVSS 10.0 authentication bypass in Identity Services Engine and ISE Passive Identity Connector. An unauthenticated remote attacker reaches it with a crafted request to an API endpoint. The advisory ships with no workarounds, only a detection recipe.

Why it matters. ISE is the device that decides what is allowed onto the network, so an authentication flaw here is not one more exposed appliance: it is the policy engine in front of the 802.1X decisions everything else inherits. An intruder inside the policy engine sits inside the authority every other control inherits, and the advisory's own recovery guidance says to re-image nodes rather than trust what they report. Treat the device's own record as its least trustworthy account.

Mechanism. Cisco files it under CWE-648, incorrect use of privileged APIs. An API endpoint behind the management interface did not hold the caller to an authentication decision before doing privileged work, so a request arriving with no identity was served instead of refused. That is the whole bug: a check that should have run and did not, rather than a memory corruption trick. Most auth bypasses are this shape, a trust decision made somewhere other than where the privilege is actually exercised.

What to do. Upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4. Release 3.0 is past end of software maintenance and receives no fix, so that is a migration rather than a patch. Cisco lists no workaround, only a mitigation: put infrastructure ACLs on the management interface so only required management traffic can reach the device. Patching does not tell you whether the door was already open. Cisco's remediation guidance has you review ise-kong/access.log for suspicious usernames on every node of a distributed deployment, cross-check firewall and network logs outside the device for unexpected transfers, and re-image nodes where activity looks malicious.