CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Identity Services Engine

product · product:cisco-identity-services-engine

Coverage
3
first 2026-06-19 → last 2026-11-01
Latest activity
2026-11-01
Eight eMudhra CA keys were guessable; Windows drops seven certificates, and Java, Python, Go and GitLab need…
Peak priority
critical
1 critical · 1 notable · 1 routine
Targets
public-sector
sectors: public-sector, technology
Sources cited
31
22 hosts

Action items (5)

Do-now tasks recorded on the entries about Cisco Identity Services Engine, newest first. Check the date before acting on an older one.

  • Update every non-browser TLS client that keeps its own CA bundle or does not check revocation to a fixed version: standalone Java runtimes, including those already updated on 2026-10-21, to the update of Oracle's Security Alert CVE-2026-114820 or OpenJDK (Oracle Database Server, Autonomous Health Framework and OPatch installations too), Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 together with pip 26.2.2 or later, Go 1.27.3 or 1.26.10, and self-managed GitLab to a fixed patch release together with GitLab Runner 19.5.1; then confirm with curl against the incident tracker's test host that the client rejects the certificate.
    2026-10-21CVE-2026-91403 +2
  • Replace, by hand where the ACME client does not support ACME Renewal Information, every TLS certificate your organisation holds that chains to emSign ECC Root CA - G3 or to another of the seven certificates Microsoft removed from the Windows and Edge trust lists, because Chrome's removal of the G3 root was due on 2026-10-27 and the Windows change takes effect when the trust-list update reaches a device; deliver the updated Disallowed Certificate Trust List and the trust-list changes Microsoft describes, including its out-of-band update of 2026-10-26, to Windows devices that do not receive automatic certificate-trust updates.
    2026-10-21CVE-2026-91403 +2
  • Apply Cisco's remediation now for the products its eMudhra advisory (version 1.5) lists with a fix or a procedure available: the guidance for Secure Firewall ASA, FTD and FMC, Secure Email Gateway and Secure Email and Web Manager (run the updatenow command where updates are manual), Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1 and ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2).
    2026-10-21CVE-2026-91403 +2
  • Immediate action: Apply infrastructure ACLs today to permit only required management/control-plane traffic to every internet- or network-reachable Cisco ISE / ISE-PIC node, then upgrade to the fixed release on the fastest available maintenance window; there is no other mitigation. Because successful exploitation reaches root, treat the appliance's own logs as untrustworthy for ruling out compromise: cross-check network and firewall logs outside the ISE node for uploads initiated from the device to external IP addresses or downloads from malicious IP addresses, in addition to reviewing access.log for suspicious usernames on the affected API endpoint. Re-image any node where malicious activity is suspected and restore from configuration backup.
    2026-09-17CVE-2026-76460 +3
  • Apply infrastructure ACLs to every Cisco ISE/ISE-PIC node today restricting management-plane access to required sources only, then patch to 3.1 Patch 12 / 3.2 Patch 11 / 3.3 Patch 12 / 3.4 Patch 7 / 3.5 Patch 4 (migrate off 3.0, which is past End of Software Maintenance) at the earliest window.
    2026-09-17CVE-2026-76460 +3

Defender insights

What each entry about Cisco Identity Services Engine tells a defender to do, newest first.

2026-10-21NOTABLEEight eMudhra CA keys were guessable; Windows drops seven certificates, and Java, Python, Go and GitLab need updates

Exposure · triage · detection

2026-09-17CRITICALexploitedCisco confirms active exploitation of an unauthenticated ISE API bypass that can reach root, found during a Cisco TAC support case

Triage

2026-06-19ROUTINECisco fixes an admin-to-root command flaw across ISE releases up to 3.5 and an unauthenticated credential-hash leak in 3.4 and 3.5; no exploitation known

Exposure

Story timeline

  1. 2026-10-21eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)
    active-threatsEight eMudhra CA keys were guessable; Windows drops seven certificates, and Java, Python, Go and GitLab need updates
  2. 2026-09-17CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)
    trending-vulnerabilitiesCisco confirms active exploitation of an unauthenticated ISE API bypass that can reach root, found during a Cisco TAC support case
  3. 2026-06-19Cisco ISE CVE-2026-20181 / CVE-2026-20190: administrator-level command execution to root and an unauthenticated disclosure of hashed credentials, two independent flaws
    trending-vulnerabilitiesCisco fixes an admin-to-root command flaw across ISE releases up to 3.5 and an unauthenticated credential-hash leak in 3.4 and 3.5; no exploitation known

Hunting pivots

CVEs (exploited first)
CVE-2026-76460CVE-2026-114820CVE-2026-115557CVE-2026-20130CVE-2026-20181CVE-2026-20190CVE-2026-20192CVE-2026-76423CVE-2026-91403
Releases covered
Cisco Identity Services Engine ×3
Tags
auth-bypass ×2identity ×2patch-available ×2rce ×2vulnerabilities ×2actively-exploitedcisa-kevinfo-disclosurepre-authpriv-escsupply-chain
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 3 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Privilege EscalationExploitation for Privilege Escalation
  • Credential AccessUnsecured Credentials · Adversary-in-the-Middle
  • CollectionAdversary-in-the-Middle

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-17/cve-2026-76460-cisco-ise-auth-bypass-root-rce · 2026-06-19/cisco-ise-cve-2026-20181-cve-2026-20190-an-unauthenticated-c · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-19/cisco-ise-cve-2026-20181-cve-2026-20190-an-unauthenticated-c · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-06-19/cisco-ise-cve-2026-20181-cve-2026-20190-an-unauthenticated-c · ATT&CK page ↗

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-10-21/emudhra-intermediate-ca-keys-recoverable-trust-store-updates · ATT&CK page ↗

Collection TA0009

T1557Adversary-in-the-Middle×1

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-10-21/emudhra-intermediate-ca-keys-recoverable-trust-store-updates · ATT&CK page ↗

Entries about Cisco Identity Services Engine (3)

2026-10-21 · view entry permalink →

NOTABLECVE-2026-91403 +2updatedNATOA1

eMudhra: the private keys of eight intermediate CA certificates were trivially recoverable, so anyone could forge trusted HTTPS certificates; browsers block them, clients with their own trust store or no revocation checking need an update (CVE-2026-111943 in Go)

On 2026-10-17 a researcher reported to the Chrome Root Program, and Mozilla received a report the same day, that the private keys of eight eMudhra subordinate CA certificates were compromised: the keys were generated with insufficient randomness, which lets anyone forge trusted HTTPS certificates to impersonate any website against clients that have not removed trust in those CAs (Google, 2026-10-20; Mozilla, 2026-10-20). BleepingComputer, citing Mozilla's incident report, says all eight were P-384 keys generated in April 2025 with values below 256, so testing 256 numbers recovers a key, and that eMudhra blames a key-generation script error and found no evidence of end-user certificates (BleepingComputer, 2026-10-20). Google reports that no certificates chaining to the six TLS intermediates were logged to Certificate Transparency before it blocked them, so CT-enforcing clients such as Chrome could not have been attacked (Google, 2026-10-20); the tracker says it is not known whether attackers used the flaw against other clients (Dennis Jackson, 2026-10-20).

Chrome blocked the intermediates on 2026-10-17, Firefox through OneCRL the same day, Microsoft platforms on 2026-10-20 and Apple devices on 2026-10-22, and eMudhra revoked all eight (Dennis Jackson, 2026-10-20; BleepingComputer, 2026-10-20). Microsoft went further: an out-of-band Windows update of 2026-10-26 removes seven certificates, six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list, and the same seven left the Edge trust list on 2026-10-27 (Microsoft, 2026-10-26). Google removed the root that signed them, emSign ECC Root CA - G3, from the Chrome Root Store, with the removal expected to reach devices on 2026-10-27, after which some legitimate certificates chaining to it will stop working in Chrome (Google, 2026-10-20). Go 1.27.3 and 1.26.10 filter chains that contain the intermediates in crypto/x509, tracked as CVE-2026-111943 (Go team, 2026-10-20), and GitLab's release of 2026-10-29 removes trust for the eight intermediates in self-managed CE and EE, with GitLab Runner 19.5.1 and the AI Gateway needing separate updates (GitLab, 2026-10-29).

Oracle's Security Alert of 2026-10-21 for CVE-2026-91403 (CVSS 3.1 9.1, component JSSE, remotely exploitable without authentication through the component's APIs) provided Java updates that distrust the impacted eMudhra intermediate CA certificates (Oracle, 2026-10-21), and a second Security Alert of 2026-10-24, CVE-2026-114820 (CVSS 3.1 9.1, same component and exposure), provides updates that remove the impacted root CA certificates and, from its revision of 2026-10-30, also covers the Java component of Oracle Database Server (not client-only installations), Autonomous Health Framework and OPatch (Oracle, 2026-10-30). OpenJDK's guidance tells users of a standalone runtime to act immediately even if they updated in the past few days, preferably by installing an update whose release note names JDK-8395690 and CVE-2026-114820 (OpenJDK, 2026-10-24). If no update is available, OpenJDK gives two alternatives: delete the aliases emsignrootcag1, emsignrootcag2, emsigneccrootcag3 and comodoaaaca from the runtime's cacerts keystore and restart it, repeating for each installation, or enable revocation checking with -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true on the application's java command line (OpenJDK, 2026-10-24). OpenJDK packages from Red Hat, Oracle Linux, Fedora, Arch Linux and Gentoo most likely use the operating system's certificates; Debian, Devuan and Ubuntu need a manual workaround because updating ca-certificates and ca-certificates-java does not refresh the keystore (as superuser, remove /etc/ssl/certs/java/cacerts and run update-ca-certificates --fresh) (OpenJDK, 2026-10-24).

Triage: a site that still chains to emSign ECC Root CA - G3 failing in Chrome after 2026-10-27, or a certificate that chains to one of the seven certificates Microsoft removed failing in Windows or Edge once the change reaches the device, is the announced root removal, not an attack (Google, 2026-10-20; Microsoft, 2026-10-26).

enabling anyone to forge trusted HTTPS certificates to impersonate any website against clients that have not yet removed trust in those CAs.

Google (Chrome Root Program and Android Security) 2026-10-20

many other clients do not consume revocation information and require software updates to ensure they no longer trust the compromised intermediates.

We do not know if attackers exploited the flawed key generation to target these clients.

Dennis Jackson (eMudhra intermediate CA compromise incident tracker) 2026-10-20

crypto/x509: mitigation for security concerns with a specific Certificate Authority

Go team (golang-announce) 2026-10-20

This Security Alert addresses CVE-2026-91403 by providing Java updates which distrusts the set of impacted intermediate CA certificates related to eMudhra.

Oracle (Security Alert CVE-2026-91403) 2026-10-21

This Security Alert addresses CVE-2026-114820 by providing Java updates that remove the set of impacted root CA certificates related to eMudhra.

Oracle (Security Alert CVE-2026-114820) 2026-10-24

take one of the following actions immediately; even if you have updated your runtime in the past few days.

OpenJDK (Compromised Certificates and OpenJDK Java Runtimes) 2026-10-24

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.

Python Software Foundation (security-announce, CVE-2026-115557) 2026-10-24

Chrome has told eMudhra that standard ACME clients do not replace certificates outside their renewal window unless they support ACME Renewal Information (ARI) or someone steps in by hand.

The Hacker News 2026-10-22

On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.

Microsoft Security Response Center

GitLab has removed trust for eight eMudhra intermediate CA certificates whose private keys have been compromised.

GitLab

The Cisco PSIRT is not aware of any malicious use of the issue that is described in this advisory.

Cisco PSIRT
Updaterun 2026-10-23T0256Z-intelheadlinesummaryaffected_productscvessourcesevidenceactionsbodyentities

On 2026-10-21 Oracle issued Security Alert CVE-2026-91403 and the OpenJDK project an advisory for the same event, which reaches Java runtimes as well; Oracle says it also applies to sandboxed Java Web Start and applet clients (Oracle, 2026-10-21). Affected are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20, and OpenJDK lists 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.32.1 and 8u504 and earlier (Oracle, 2026-10-21; OpenJDK, 2026-10-21). NCSC.ch's advisory of 2026-10-22 lists the exploitation status as unknown and the OpenJDK guidance as the temporary mitigation (NCSC.ch, 2026-10-22).

Updaterun 2026-10-25T0256Z-intelheadlinesummarycvesaffected_productsentitiessourcesevidenceactionsbody

Oracle's second Security Alert of 2026-10-24, CVE-2026-114820 (CVSS 3.1 9.1, component JSSE, remotely exploitable without authentication through the component's APIs), provides Java updates that remove the impacted root CA certificates related to eMudhra (Oracle, 2026-10-24). Its affected list names Oracle Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, and the OpenJDK advisory of the same day lists 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.32.1 and 8u504 and earlier as affected (Oracle, 2026-10-24; OpenJDK, 2026-10-24). OpenJDK tells users of a standalone runtime to act immediately even if they updated in the past few days, by installing an update whose release note names JDK-8395690 and CVE-2026-114820 or, failing that, by deleting the cacerts aliases emsignrootcag1, emsignrootcag2, emsigneccrootcag3 and comodoaaaca or enabling revocation checking (OpenJDK, 2026-10-24). The same page now says Debian, Devuan and Ubuntu OpenJDK packages need the keystore recreated by hand, because updating ca-certificates and ca-certificates-java does not refresh it, which replaces the earlier statement that updating the operating system's certificates suffices there (OpenJDK, 2026-10-24).

The Python Software Foundation announced CVE-2026-115557 on 2026-10-24: the ssl module now carries a denylist of known compromised certificates that is rejected whatever the SSLContext policy, so it works without revocation checking (Python Software Foundation, 2026-10-24). ENISA's record scores it 9.4 (CVSS 4.0) and lists CPython before 3.16.0 as affected, and the announcement names no release that carries the denylist (ENISA EUVD, 2026-10-24). The Python releases that carry the ssl denylist are 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 (Python Insider, 2026-10-26), and Christian Heimes stresses in the announcement thread that pip before 26.2.2 keeps trusting the compromised intermediates whatever the system trust store holds, because it always loads its own vendored certifi (Dennis Jackson, 2026-10-20; Python Discourse, 2026-10-20).

Cisco's informational advisory, version 1.1 of 2026-10-24, lists as impacted with remediation a TLS policy that blocks the known eMudhra issuers on Secure Firewall Management Center, Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1, ThousandEyes Enterprise Agent (Application-hosting Agent 5.2.2, 2026-10-23), Meraki MV Smart Camera Firmware (2026-11-18), IOS XR 26.4.1 (2026-11-30) and Ultra Cloud Core Subscriber Microservices Infrastructure 2026.04.1 (November 2026), keeps further products under investigation, and says Cisco PSIRT is not aware of malicious use (Cisco PSIRT, 2026-10-24).

eMudhra's board decided on 2026-10-22 to leave the global SSL/TLS certificate business, and its G1 RSA roots keep serving customers during the transition (eMudhra, 2026-10-22). The Hacker News relays Chrome's count of about 30,800 unexpired certificates under the emSign ECC Root CA - G3, which Chrome stops trusting on 2026-10-27, as of 2026-10-21, 99.9 percent of them issued through InCommon, and relays Chrome's point that standard ACME clients do not replace a certificate outside its renewal window unless they support ACME Renewal Information or someone steps in by hand (The Hacker News, 2026-10-22).

Updaterun 2026-11-01T0256Z-intelheadlinesummaryentitiesaffected_productssourcesevidencesourcing_noteactionsbodycves

Microsoft released an out-of-band Windows update on 2026-10-26 that removes seven certificates associated with the affected hierarchies, six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list, and removed the same seven from the Edge trust list on 2026-10-27; removing a root is a separate and broader decision than blocking the compromised intermediates, which Microsoft had done through its Disallowed Certificate Trust List on 2026-10-20 (Microsoft, 2026-10-26). Microsoft tells organizations to keep automatic trust-list updates flowing, to make sure disconnected Windows devices receive the updated trust lists, and to replace certificates that chain to one of the seven before the change reaches their devices, and it warns that software that does not check revocation or the disallowed list could still accept certificates tied to the compromised keys if trust is restored locally (Microsoft, 2026-10-26).

Cisco's advisory is at version 1.5 of 2026-10-30. It lists remediation for Secure Firewall ASA, FTD and FMC (guidance page), Secure Email Gateway and Secure Email and Web Manager (updated automatically to Trusted Root 2.8, with the updatenow command where updates are manual) and Packaged and Unified Contact Center Enterprise (CSCwx36769); it dates the fixes for ISE and ISE-PIC to ISE 3.5P5 in December 2026 and 3.3P13 and 3.4P8 in April 2027, and still lists IOS XE Software, MDS 9000 and Nexus switches among the impacted products under investigation; Cisco says it is not aware of malicious use (Cisco PSIRT, 2026-10-30). GitLab's patch release of 2026-10-29 removes trust for the eight intermediates in self-managed CE and EE and says GitLab Runner 19.5.1 and the AI Gateway must be updated separately because they verify certificates on their own (GitLab, 2026-10-29). Python's expedited releases of 2026-10-26, 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18, now carry the built-in denylist for the compromised intermediates (Python Insider, 2026-10-26). Oracle's revision 2 of Security Alert CVE-2026-114820, dated 2026-10-30, adds the Java component of Oracle Database Server (19.3 to 19.32, 21.3 to 21.23 and 23.4.0 to 23.26.3, not client-only installations), Autonomous Health Framework Trace File Analyzer 26.3 to 26.10, OPatch 12.2.0.1.16 to 12.2.0.1.52 and Hospitality Cruise Shipboard Property Management 23.3.4 to 23.3.6, each remotely exploitable without authentication at CVSS 3.1 9.1 (Oracle, 2026-10-30).

Correctionrun 2026-11-01T1312Z-auditbodyevidence

Python 3.15.1, 3.14.9 and 3.13.17 do not carry the protection: the releases whose ssl module blocks the compromised eMudhra keys are 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 (Python Insider, 2026-10-26). A host on 3.15.1, 3.14.9 or 3.13.17 still needs the later release.

incident21 Oct 03:43Zmulti-sourceOpen finding →
Sources: Google (Chrome Root Program and Android Security) · Dennis Jackson (eMudhra intermediate CA compromise incident tracker) · Mozilla Security Blog · Go team (golang-announce) · BleepingComputer · Oracle (Security Alert CVE-2026-91403) · OpenJDK (Vulnerability Advisory 2026/10/21) · NCSC.ch Security Hub (advisory 13091) · Oracle (Security Alert CVE-2026-114820) · OpenJDK (Vulnerability Advisory 2026/10/24) · OpenJDK (Compromised Certificates and OpenJDK Java Runtimes) · Python Software Foundation (security-announce, CVE-2026-115557) · ENISA EUVD (EUVD-2026-109299) · Cisco PSIRT (cisco-sa-emudhra-info, version 1.1) · Python Discourse (eMudhra information for Python users) · The Hacker News · eMudhra (press release) · Microsoft Security Response Center (updated 2026-10-27) · Cisco PSIRT (cisco-sa-emudhra-info, version 1.5) · GitLab (patch release 19.5.3, date of its patch-release feed entry) · Python Insider (release post; the page carries no date, 2026-10-26 is the date of its blog feed entry) · Dennis Jackson (eMudhra intermediate CA compromise incident tracker, update of 28 October) · Oracle (Security Alert CVE-2026-114820, revision 2)

2026-09-17 · view entry permalink →

CRITICALCVE-2026-76460 +3exploitedupdatedNATOA1

CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)

Cisco disclosed CVE-2026-76460 (CVSS 3.1 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) on 2026-09-16: an unauthenticated, remote attacker can bypass authentication on an API endpoint of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) due to insufficient authentication control, affecting ISE and ISE-PIC releases before the fixed patch levels "regardless of device configuration" (Cisco PSIRT, 2026-09-16). Cisco states the flaw was found during the resolution of a Cisco TAC support case and that it is aware of active exploitation (Cisco PSIRT, 2026-09-16); a successful exploit bypasses the web-based management interface and, per Cisco's own advisory, "threat actors may obtain command execution with root privileges" (Cisco PSIRT, 2026-09-16). There is no workaround; the only mitigation is restricting management-plane access via infrastructure ACLs. Fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4; Cisco ISE 3.0 has reached End of Software Maintenance and must migrate to a supported, fixed release (Cisco PSIRT, 2026-09-16). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-09-16; CISA KEV JSON feed, 2026-09-16).

This CVE was part of a bundled disclosure of 15 distinct Cisco ISE advisories the same day (Cisco PSIRT, 2026-09-16). A sibling flaw, CVE-2026-76423 (CVSS 10.0, also unauthenticated and affecting ISE and ISE-PIC before the same fixed patch levels "regardless of device configuration"), removes the same authentication boundary via a separate API endpoint, letting an attacker read or modify ISE configuration and identity data with administrative privileges; Cisco states it is "not aware of any public announcements or malicious use" of this second flaw as of disclosure, but it shares the same fixed-release schedule (Cisco PSIRT, 2026-09-16).

Triage: a legitimate administrative session against the ISE API originates from an authenticated, known management source; the discriminator here is that exploitation reaches the API without any authentication at all, so any successful request against the affected endpoint from outside expected management-plane sources is itself the signal, and because a root-level attacker can edit or delete access.log entries, an apparently clean on-box log is not evidence of an intact device. Cisco's guidance is to corroborate against firewall and network logs external to the ISE node for uploads initiated from the device to external IP addresses or downloads from malicious IP addresses.

The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

This vulnerability was found during the resolution of a Cisco Technical Assistance Center (TAC) support case.

Upon successful exploitation of this vulnerability, threat actors may obtain command execution with root privileges.

Cisco PSIRT 2026-09-16

Of the 21 vulnerabilities in total, 13 are rated critical. Based on the CVSS scores Cisco published, four vulnerabilities can be exploited remotely without authentication. (translated from Dutch)

Four vulnerabilities, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460, have a CVSS score of 10.0. (translated from Dutch)

NCSC-NL (NCSC-2026-0382) 2026-09-17
Updaterun 2026-09-18T0410Z-intelcvessourcesevidencebody

CVE-2026-76460 was one part of a much larger Cisco ISE hardening release the same day. NCSC-NL's advisory scopes 21 of the disclosed vulnerabilities and states: "Of the 21 vulnerabilities in total, 13 are rated critical. Based on the CVSS scores Cisco published, four vulnerabilities can be exploited remotely without authentication" (translated from Dutch) (NCSC-NL, 2026-09-17). Two further CVEs join the maximum-severity tier alongside the already-covered CVE-2026-76460 and CVE-2026-76423: "Four vulnerabilities, CVE-2026-20130, CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460, have a CVSS score of 10.0" (translated from Dutch) (NCSC-NL, 2026-09-17); Cisco groups multiple underlying flaws sharing a CWE classification for a hardening release under one CVE ID, with the CVSS score representing the highest-scoring underlying flaw in each bundle (Cisco PSIRT hardening advisory, 2026-09-16). CERT-FR's combined advisory reports Cisco's statement that CVE-2026-76460 is actively exploited (CERT-FR, 2026-09-17). Cisco's advisory for CVE-2026-76423 and five further flaws says Cisco is not aware of malicious use of any of them (Cisco PSIRT, 2026-09-16), and its hardening advisory says the same of the flaws it covers except where noted (Cisco PSIRT hardening advisory, 2026-09-16). Cisco's hardening advisory marks the improper-access-control class covered by CVE-2026-20192 with the note that one vulnerability belonging to that class is known to be actively exploited, and points to Cisco's Identity Services Engine Authentication Bypass advisory for it (Cisco PSIRT hardening advisory, 2026-09-16). That advisory covers CVE-2026-76460 (Cisco PSIRT, 2026-09-16). CERT-FR also reports Cisco's statement that ISE 3.1 and 3.2, which leave support on 30 November 2027, have not received a fix for eight of the disclosed CVEs (CERT-FR, 2026-09-17). Cisco's hardening advisory places both trains in the Software Maintenance phase, where only fixes for critical vulnerabilities are included, and advises migrating to a supported release that includes all of the hardening fixes (Cisco PSIRT hardening advisory, 2026-09-16).

Correctionrun 2026-09-30T0639Z-auditbodysourcesactionsimmediate_action

The 2026-09-18 text said no other CVE in the release was named exploited by any source. It also credited CERT-FR with saying that only CVE-2026-76460 is exploited, while CERT-FR reports Cisco's statement that CVE-2026-76460 is actively exploited (CERT-FR, 2026-09-17) and the exclusivity comes from Cisco's other advisories, which report no malicious use of the flaws they cover except where noted (Cisco PSIRT, 2026-09-16) (Cisco PSIRT hardening advisory, 2026-09-16). Cisco's hardening advisory notes that one vulnerability in the improper-access-control class covered by CVE-2026-20192 is known to be actively exploited and refers to its Identity Services Engine Authentication Bypass advisory for it (Cisco PSIRT hardening advisory, 2026-09-16), the advisory for CVE-2026-76460 (Cisco PSIRT, 2026-09-16). The same text said ISE 3.1 and 3.2 will not receive a fix at all for eight of the disclosed CVEs. CERT-FR reports only that those trains have not received a fix for them (CERT-FR, 2026-09-17), and Cisco says 3.1 and 3.2 now take only fixes for critical vulnerabilities (Cisco PSIRT hardening advisory, 2026-09-16). The eight are CVE-2026-20247, CVE-2026-20282, CVE-2026-20300 and CVE-2026-76424 through CVE-2026-76428 (CERT-FR, 2026-09-17). None of them is one of the four CVSS 10.0 flaws, which are fixed on every supported train including 3.1 Patch 12 and 3.2 Patch 11 (Cisco PSIRT hardening advisory, 2026-09-16) (Cisco PSIRT, 2026-09-16) (Cisco PSIRT, 2026-09-16). CERT-FR also notes that ISE-PIC is no longer sold and 3.4 is its last maintained release (CERT-FR, 2026-09-17). Where malicious activity is suspected, Cisco recommends re-imaging the affected nodes and restoring from configuration backup (Cisco PSIRT, 2026-09-16). The main text also described ISE as standard infrastructure across enterprise and public-sector networks without a source, and that sentence is removed.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarycvestechniquesbodyimmediate_actionactions

Cisco's advisory says only that the flaw "was found during the resolution of a Cisco Technical Assistance Center (TAC) support case" (Cisco PSIRT, 2026-09-16); it does not say whose case it was, and the earlier wording that set it against internal research was not Cisco's. Cisco's hardening advisory describes CVE-2026-20130 as a grouped class of improper output neutralization, covering command, code, XML and resource injection and cross-site scripting, not as a single remote code execution flaw (Cisco PSIRT hardening advisory, 2026-09-16).

Improvementrun 2026-10-21T0800Z-auditbodycvesimmediate_actionsummary

Cisco scopes both flaws to Cisco ISE and ISE-PIC "regardless of device configuration" on releases before the fixed patch levels (3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4), so a node already on its train's fixed patch is not affected (Cisco PSIRT, 2026-09-16; Cisco PSIRT, 2026-09-16). Cisco's access-log check is to look for suspicious usernames in each node's access.log, and its command, filtering show logging application ise-kong/access.log output, is a non-exhaustive example rather than a fixed search string (Cisco PSIRT, 2026-09-16).

vulnerability17 Sep 04:31Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · CISA (KEV addition alert) · CISA Known Exploited Vulnerabilities catalog (JSON feed) · Cisco PSIRT (advance notification) · CERT-FR (CERTFR-2026-AVI-1197) · NCSC-NL (NCSC-2026-0382) · Cisco PSIRT (ISE hardening release)

2026-06-19 · view entry permalink →

ROUTINECVE-2026-20181 +1updatedNATOA2

Cisco ISE CVE-2026-20181 / CVE-2026-20190: administrator-level command execution to root and an unauthenticated disclosure of hashed credentials, two independent flaws

Cisco's advisory of 2026-06-17 covers two independent flaws in Identity Services Engine and ISE-PIC; Cisco states that exploiting one is not required to exploit the other (Cisco PSIRT). CVE-2026-20181 (CVSS 9.1, SIR Critical) lets an attacker with valid administrative credentials send a crafted HTTP request that gives user-level access to the underlying operating system and then root; on a single-node deployment it can also take the node down (Cisco PSIRT). It affects releases 3.1 to 3.5, and Cisco tells releases earlier than 3.1 to migrate to a fixed release; it is fixed in 3.3 Patch 11, 3.4 Patch 6, 3.5 Patch 4 or a hot patch for 3.5 Patch 3, with 3.1 Patch 12 and 3.2 Patch 11 scheduled for September 2026 (Cisco PSIRT). CVE-2026-20190 (CVSS 7.5, SIR High) lets an unauthenticated attacker read sensitive information, including hashed credentials, through improper authorization checks; it affects only 3.4 and 3.5, fixed in 3.4 Patch 6 and 3.5 Patch 3 (Cisco PSIRT). Cisco knows of no public announcements or malicious use, and lists no workarounds (Cisco PSIRT). SecurityWeek and CERT-Bund relayed the advisory (SecurityWeek, 2026-06-18) (CERT-Bund WID-SEC-2026-1989).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarytechniquesaffected_productscvessourcesclassificationdeep_divedeep_dive_categorybodypriorityregionssectorsevent_date

Cisco states that the two vulnerabilities are not dependent on one another (Cisco PSIRT); the earlier chain of a credential leak feeding root execution was not in any source. CVE-2026-20181 requires valid administrative credentials and affects releases 3.1 to 3.5, with releases earlier than 3.1 told to migrate to a fixed release, with a hot patch available for 3.5 Patch 3, and CVE-2026-20190 discloses information including hashed credentials (Cisco PSIRT). The priority moves from notable to routine: Cisco reports no public announcements or malicious use, and the update is a patch-cycle item.

vulnerability19 Jun 05:21Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · SecurityWeek · CERT-Bund

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns2
  • Threats1

Source distribution

  • sec.cloudapps.cisco.com6 (19%)
  • openjdk.org3 (10%)
  • cisa.gov2 (6%)
  • oracle.com2 (6%)
  • advisories.ncsc.nl1 (3%)
  • bleepingcomputer.com1 (3%)
  • blog.google1 (3%)
  • blog.mozilla.org1 (3%)
  • other14 (45%)
All cited sources (31)