Critical Vulnerabilities in Cisco Identity Services Engine and ISE-PIC

Cisco has disclosed three vulnerabilities impacting the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The affected versions include releases prior to 3.0, as well as versions 3.1, 3.2, 3.3, 3.4, and 3.5. These flaws, identified as CVE-2026-20192 (Improper Access Control), CVE-2026-76423 (Authentication Bypass by Spoofing), and CVE-2026-76460 (Incorrect Use of Privileged APIs), enable unauthenticated attackers to bypass security controls, modify configurations, and obtain administrative privileges.

Cisco has confirmed active exploitation of CVE-2026-76460, and it has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Given the high-privilege nature of ISE within network environments, these vulnerabilities pose a significant threat to organizational security, potentially allowing attackers to gain full administrative access to identity and access management systems. Organizations are advised to update to the latest patched releases immediately and restrict management interface access.

Impact

Successful exploitation of these vulnerabilities allows unauthenticated attackers to gain unauthorized administrative access to the Cisco ISE platform. This results in the ability to modify identity data, change system configurations, and intercept or manipulate sensitive identity information. In scenarios where ISE is used to control network access or authenticate internal users, successful compromise can lead to broad unauthorized access across the enterprise network.

Recommendation

• Upgrade all Cisco ISE and ISE-PIC instances to the following patched versions immediately: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4.
• Prioritize remediation of CVE-2026-76460 due to confirmed in-the-wild exploitation.
• Restrict network access to management interfaces for all Cisco ISE and ISE-PIC nodes using access control lists (ACLs) and network segmentation to trusted administration networks.
• Review administrative and API access logs for unauthorized or unexpected configuration changes or anomalous login activity.
• If compromise is suspected, re-image affected nodes and perform a full restore from known-good backups as attackers may have achieved persistent administrative access.