Secuno
ENNL
Book demo

CVE-2026-76460

10.0 CRITICALActively exploited (CISA KEV)
  1. Published16 Sept 2026
  2. Added to CISA KEV16 Sept 2026
  3. Remediation due19 Sept 2026
Actively exploited (CISA KEV)

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Added to KEV: 16 Sept 2026Federal remediation due: 19 Sept 2026

Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-637278.8
Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper…
CVE-2026-544248.4
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts…
CVE-2026-412259.1
A vulnerability exists in iControl REST where a highly privileged, authenticated…
CVE-2026-413869.1
OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap…
CVE-2026-413299.9
OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to…
CVE-2026-356698.8
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in…

Frequently asked

Is CVE-2026-76460 being actively exploited?

Yes. CVE-2026-76460 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 16 Sept 2026.

How severe is CVE-2026-76460?

CVE-2026-76460 has a CVSS 3.1 base score of 10.0, rated critical.

How do I fix CVE-2026-76460?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-76460 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.