CVE-2026-76460Critical· 10.0▾ Hadal⚠ Exploited in the wild0dayPoC availableA vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attack…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 55 · likelihood 15.1 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Sep 19, 2026
1 GitHub repo · Nuclei ×1
0.8%
Last analysed / modified upstream
0.8% → 76%
Added to the CISA catalog on Sep 16, 2026. Federal remediation due Sep 19, 2026. View catalog ↗
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
identity_services_engine = 3.1.0identity_services_engine = 3.2.0identity_services_engine = 3.3.0identity_services_engine = 3.4.0identity_services_engine = 3.5.0identity_services_engine_passive_identity_connector = 3.1.0identity_services_engine_passive_identity_connector = 3.2.0identity_services_engine_passive_identity_connector = 3.3.0identity_services_engine_passive_identity_connector = 3.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76504Critical· 9.8A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …
CVE-2026-76428Medium· 4.9A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concate…
CVE-2026-76425High· 7.6A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are …
CVE-2026-76426Medium· 4.9A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of spe…
CVE-2026-76427Medium· 4.9A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-contro…
CVE-2026-76424High· 7.2A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations