Cisco Identity Services Engine (ISE) – Incorrect Use of Privileged APIs (CVE‑2026‑76460) Enables Unauthenticated Remote Access
What It Is — Cisco ISE and the ISE Passive Identity Connector contain an improper use of privileged APIs that can be invoked without authentication.
Exploitability — The flaw allows a remote, unauthenticated attacker to bypass the web‑based management console and gain full device control. No public exploit has been observed, but the CVSS v3.1 base score is 9.8 (Critical), indicating a high likelihood of exploitation once a weaponized exploit appears.
Affected Products — Cisco Identity Services Engine (ISE) 2.9 through 3.2 and ISE‑Passive Identity Connector (ISE‑PIC) 2.9 through 3.2.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The vulnerability demonstrates how a missing safeguard around privileged APIs can break the “only authorized users may manage the system” control objective.
- Continuous evidence – Detecting and logging privileged‑API calls is essential evidence for auditors that the organization enforces least‑privilege and monitors privileged activity.
- Audit‑ready posture – Remediating the flaw and proving the fix through verifiable change‑management records satisfies multiple framework requirements (e.g., NIST CSF Identify and Protect functions).
Recommended Actions
- Apply Cisco’s security patch for CVE‑2026‑76460 immediately.
- Review and harden API exposure: disable any unnecessary ISE‑PIC connectors and enforce mutual TLS for remaining APIs.
- Enable detailed logging of all privileged‑API calls and integrate logs into a SIEM for continuous monitoring.
- Conduct a focused penetration test on the management interface to confirm the remediation.
- Map the remediation to the “Access Control – Authorized Access to Management Interfaces” control objective and capture evidence for audit.
Source: CISA KEV – CVE‑2026‑76460