CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Identity Services Engine CWE-class-grouped bundle CVE from the Sept 2026 hardening release (CVSS 10.0), not reported exploited

cve · CVE-2026-20130

Coverage
1
first 2026-09-17 → last 2026-10-21
Latest activity
2026-09-18
Cisco confirms active exploitation of an unauthenticated ISE API bypass that can reach root, found during a…
Peak priority
critical
1 critical
Targets
public-sector
sectors: public-sector, technology
Sources cited
8
4 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-20130, newest first. Check the date before acting on an older one.

  • Immediate action: Apply infrastructure ACLs today to permit only required management/control-plane traffic to every internet- or network-reachable Cisco ISE / ISE-PIC node, then upgrade to the fixed release on the fastest available maintenance window; there is no other mitigation. Because successful exploitation reaches root, treat the appliance's own logs as untrustworthy for ruling out compromise: cross-check network and firewall logs outside the ISE node for uploads initiated from the device to external IP addresses or downloads from malicious IP addresses, in addition to reviewing access.log for suspicious usernames on the affected API endpoint. Re-image any node where malicious activity is suspected and restore from configuration backup.
    2026-09-17CVE-2026-76460 +3
  • Apply infrastructure ACLs to every Cisco ISE/ISE-PIC node today restricting management-plane access to required sources only, then patch to 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4 (migrate off 3.0, which is past End of Software Maintenance) at the earliest window.
    2026-09-17CVE-2026-76460 +3

Defender insights

What each entry about CVE-2026-20130 tells a defender to do, newest first.

2026-09-17CRITICALexploitedCisco confirms active exploitation of an unauthenticated ISE API bypass that can reach root, found during a Cisco TAC support case

Triage

Story timeline

  1. 2026-09-17CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)
    trending-vulnerabilitiesCisco confirms active exploitation of an unauthenticated ISE API bypass that can reach root, found during a Cisco TAC support case

Hunting pivots

Affected products
Cisco ISE Passive Identity ConnectorCisco Identity Services Engine
Tags
actively-exploitedauth-bypasscisa-kevidentitypre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-17/cve-2026-76460-cisco-ise-auth-bypass-root-rce · ATT&CK page ↗

Entries about Cisco Identity Services Engine CWE-class-grouped bundle CVE from the Sept 2026 hardening release (CVSS 10.0), not reported exploited (1)

2026-09-17 · view entry permalink →

CRITICALCVE-2026-76460 +3exploitedupdatedNATOA1

CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)

Cisco disclosed CVE-2026-76460 (CVSS 3.1 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) on 2026-09-16: an unauthenticated, remote attacker can bypass authentication on an API endpoint of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) due to insufficient authentication control, affecting ISE and ISE-PIC releases before the fixed patch levels "regardless of device configuration" (Cisco PSIRT, 2026-09-16). Cisco states the flaw was found during the resolution of a Cisco TAC support case and that it is aware of active exploitation (Cisco PSIRT, 2026-09-16); a successful exploit bypasses the web-based management interface and, per Cisco's own advisory, "threat actors may obtain command execution with root privileges" (Cisco PSIRT, 2026-09-16). There is no workaround; the only mitigation is restricting management-plane access via infrastructure ACLs. Fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4; Cisco ISE 3.0 has reached End of Software Maintenance and must migrate to a supported, fixed release (Cisco PSIRT, 2026-09-16). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-09-16; CISA KEV JSON feed, 2026-09-16).

This CVE was part of a bundled disclosure of 15 distinct Cisco ISE advisories the same day (Cisco PSIRT, 2026-09-16). A sibling flaw, CVE-2026-76423 (CVSS 10.0, also unauthenticated and affecting ISE and ISE-PIC before the same fixed patch levels "regardless of device configuration"), removes the same authentication boundary via a separate API endpoint, letting an attacker read or modify ISE configuration and identity data with administrative privileges; Cisco states it is "not aware of any public announcements or malicious use" of this second flaw as of disclosure, but it shares the same fixed-release schedule (Cisco PSIRT, 2026-09-16).

Triage: a legitimate administrative session against the ISE API originates from an authenticated, known management source; the discriminator here is that exploitation reaches the API without any authentication at all, so any successful request against the affected endpoint from outside expected management-plane sources is itself the signal, and because a root-level attacker can edit or delete access.log entries, an apparently clean on-box log is not evidence of an intact device. Cisco's guidance is to corroborate against firewall and network logs external to the ISE node for uploads initiated from the device to external IP addresses or downloads from malicious IP addresses.

The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

This vulnerability was found during the resolution of a Cisco Technical Assistance Center (TAC) support case.

Upon successful exploitation of this vulnerability, threat actors may obtain command execution with root privileges.

Cisco PSIRT 2026-09-16

Of the 21 vulnerabilities in total, 13 are rated critical. Based on the CVSS scores Cisco published, four vulnerabilities can be exploited remotely without authentication. (translated from Dutch)

Four vulnerabilities, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460, have a CVSS score of 10.0. (translated from Dutch)

NCSC-NL (NCSC-2026-0382) 2026-09-17
Updaterun 2026-09-18T0410Z-intelcvessourcesevidencebody

CVE-2026-76460 was one part of a much larger Cisco ISE hardening release the same day. NCSC-NL's advisory scopes 21 of the disclosed vulnerabilities and states: "Of the 21 vulnerabilities in total, 13 are rated critical. Based on the CVSS scores Cisco published, four vulnerabilities can be exploited remotely without authentication" (translated from Dutch) (NCSC-NL, 2026-09-17). Two further CVEs join the maximum-severity tier alongside the already-covered CVE-2026-76460 and CVE-2026-76423: "Four vulnerabilities, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460, have a CVSS score of 10.0" (translated from Dutch) (NCSC-NL, 2026-09-17); Cisco groups multiple underlying flaws sharing a CWE classification for a hardening release under one CVE ID, with the CVSS score representing the highest-scoring underlying flaw in each bundle (Cisco PSIRT hardening advisory, 2026-09-16). CERT-FR's combined advisory reports Cisco's statement that CVE-2026-76460 is actively exploited (CERT-FR, 2026-09-17). Cisco's advisory for CVE-2026-76423 and five further flaws says Cisco is not aware of malicious use of any of them (Cisco PSIRT, 2026-09-16), and its hardening advisory says the same of the flaws it covers except where noted (Cisco PSIRT hardening advisory, 2026-09-16). Cisco's hardening advisory marks the improper-access-control class covered by CVE-2026-20192 with the note that one vulnerability belonging to that class is known to be actively exploited, and points to Cisco's Identity Services Engine Authentication Bypass advisory for it (Cisco PSIRT hardening advisory, 2026-09-16). That advisory covers CVE-2026-76460 (Cisco PSIRT, 2026-09-16). CERT-FR also reports Cisco's statement that ISE 3.1 and 3.2, which leave support on 30 November 2027, have not received a fix for eight of the disclosed CVEs (CERT-FR, 2026-09-17). Cisco's hardening advisory places both trains in the Software Maintenance phase, where only fixes for critical vulnerabilities are included, and advises migrating to a supported release that includes all of the hardening fixes (Cisco PSIRT hardening advisory, 2026-09-16).

Correctionrun 2026-09-30T0639Z-auditbodysourcesactionsimmediate_action

The 2026-09-18 text said no other CVE in the release was named exploited by any source. It also credited CERT-FR with saying that only CVE-2026-76460 is exploited, while CERT-FR reports Cisco's statement that CVE-2026-76460 is actively exploited (CERT-FR, 2026-09-17) and the exclusivity comes from Cisco's other advisories, which report no malicious use of the flaws they cover except where noted (Cisco PSIRT, 2026-09-16) (Cisco PSIRT hardening advisory, 2026-09-16). Cisco's hardening advisory notes that one vulnerability in the improper-access-control class covered by CVE-2026-20192 is known to be actively exploited and refers to its Identity Services Engine Authentication Bypass advisory for it (Cisco PSIRT hardening advisory, 2026-09-16), the advisory for CVE-2026-76460 (Cisco PSIRT, 2026-09-16). The same text said ISE 3.1 and 3.2 will not receive a fix at all for eight of the disclosed CVEs. CERT-FR reports only that those trains have not received a fix for them (CERT-FR, 2026-09-17), and Cisco says 3.1 and 3.2 now take only fixes for critical vulnerabilities (Cisco PSIRT hardening advisory, 2026-09-16). The eight are CVE-2026-20247, CVE-2026-20282, CVE-2026-20300 and CVE-2026-76424 through CVE-2026-76428 (CERT-FR, 2026-09-17). None of them is one of the four CVSS 10.0 flaws, which are fixed on every supported train including 3.1 Patch 12 and 3.2 Patch 11 (Cisco PSIRT hardening advisory, 2026-09-16) (Cisco PSIRT, 2026-09-16) (Cisco PSIRT, 2026-09-16). CERT-FR also notes that ISE-PIC is no longer sold and 3.4 is its last maintained release (CERT-FR, 2026-09-17). Where malicious activity is suspected, Cisco recommends re-imaging the affected nodes and restoring from configuration backup (Cisco PSIRT, 2026-09-16). The main text also described ISE as standard infrastructure across enterprise and public-sector networks without a source, and that sentence is removed.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarycvestechniquesbodyimmediate_actionactions

Cisco's advisory says only that the flaw "was found during the resolution of a Cisco Technical Assistance Center (TAC) support case" (Cisco PSIRT, 2026-09-16); it does not say whose case it was, and the earlier wording that set it against internal research was not Cisco's. Cisco's hardening advisory describes CVE-2026-20130 as a grouped class of improper output neutralization, covering command, code, XML and resource injection and cross-site scripting, not as a single remote code execution flaw (Cisco PSIRT hardening advisory, 2026-09-16).

Improvementrun 2026-10-21T0800Z-auditbodycvesimmediate_actionsummary

Cisco scopes both flaws to Cisco ISE and ISE-PIC "regardless of device configuration" on releases before the fixed patch levels (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4), so a node already on its train's fixed patch is not affected (Cisco PSIRT, 2026-09-16; Cisco PSIRT, 2026-09-16). Cisco's access-log check is to look for suspicious usernames in each node's access.log, and its command, filtering show logging application ise-kong/access.log output, is a non-exhaustive example rather than a fixed search string (Cisco PSIRT, 2026-09-16).

vulnerability17 Sep 04:31Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · CISA (KEV addition alert) · CISA Known Exploited Vulnerabilities catalog (JSON feed) · Cisco PSIRT (advance notification) · CERT-FR (CERTFR-2026-AVI-1197) · NCSC-NL (NCSC-2026-0382) · Cisco PSIRT (ISE hardening release)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • sec.cloudapps.cisco.com4 (50%)
  • cisa.gov2 (25%)
  • advisories.ncsc.nl1 (12%)
  • cert.ssi.gouv.fr1 (12%)

External references

NVD · cve.org · CISA KEV

All cited sources (8)