Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)

Cisco has confirmed that attackers are exploiting CVE-2026-76460, an authentication bypass in an API of Cisco Identity Services Engine (ISE). The flaw affects Cisco ISE and Cisco ISE Passive Identity Connector (ISE-PIC), releases 3.0 through 3.5, and can let unauthenticated remote attackers access devices through the web-based management interface. Organizations should review logs across every deployment node and external network and firewall logs, then upgrade to 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4; Cisco provides no workaround.