Who Guards the Gatekeeper? A 10.0 Flaw in Cisco ISE Opens Your Network Without a Password

Who Guards the Gatekeeper? A 10.0 Flaw in Cisco ISE Opens Your Network Without a Password

On 16 September 2026 Cisco published a security advisory for CVE-2026-76460, affecting Identity Services Engine and ISE Passive Identity Connector. The CVSS base score is 10.0, the maximum the scale awards. The cause is insufficient authentication controls on one API endpoint, and the effect is that an unauthenticated remote attacker can reach the management interface by sending a crafted request. Cisco states plainly that its PSIRT is aware of active exploitation, and that no workarounds are available.

The technical name means little to a business owner. The operational meaning means everything: the affected box is not a file server or a network printer. It is the appliance the rest of the network asks about the identity of everyone trying to connect. It decides that this laptop is an authorised employee, that this phone is a visitor who belongs on the guest network, and that this supplier reaches exactly one system. When the authority to make that decision falls, you do not lose one service. You lose the foundation every service stands on.

What we actually know

These facts come from Cisco's own advisory and from the CISA Known Exploited Vulnerabilities catalogue, not from press write-ups:

• Affected products: Cisco Identity Services Engine and ISE Passive Identity Connector, releases 3.1 through 3.5.
• Fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.
• Exploitation prerequisite: none. A remote, unauthenticated attacker, one crafted request to an API endpoint, no account and no password.
• Status: actively exploited according to Cisco PSIRT, and added to the Known Exploited Vulnerabilities catalogue on 16 September 2026 with a 19 September 2026 remediation due date for US federal agencies.
• Workaround: none. The only mitigation Cisco mentions is restricting access to the device with infrastructure access control lists until the patch is applied.

Three phrases in that list deserve a pause: remote, unauthenticated, and no workaround. Any vulnerability missing one of those gives you room to breathe. This one gives you nothing except patching or isolation.

Why identity appliances are worse than any other server you run

In a corporate network, systems are not equal in the consequences of their compromise. Compromise the reporting server and you lose reports. Compromise the box that governs identity and access and you have not lost a device. You have lost the meaning of the word permission across the whole network.

Whoever obtains administrative control of such a system can in principle change the policies themselves — minting an authorised identity instead of trying to defeat a control. That is the essential difference. The attack stops being an intrusion that looks abnormal in the logs and becomes an entry that looks entirely legitimate, because it came through the same gate you trust. This is the hardest case to detect, because monitoring is built on the assumption that whatever the identity system approves is by definition approved.

Add to that where these appliances sit. They live in the middle of the network and connect to every segment, because the job requires it. So a foothold on the appliance is a foothold on an open road to everything behind it. That is why identity, access and authentication systems belong at the top of the critical asset list rather than in the general network equipment inventory. We covered the same logic from a different angle in our piece on the single point of failure nobody maps.

The lesson is not about Cisco

It is easy to read this as news about one product from one vendor. That reading is comfortable and useless. Cisco shipped the fix and stated the exploitation status clearly, which is what a mature vendor is supposed to do. Security appliances from every vendor contain vulnerabilities, because they are software, and comparable advisories will follow.

The question to take away is not whether you run Cisco. It is whether you know which devices and systems authenticate the users of your network, what versions they are on, who owns patching them, and how long that actually takes. An organisation that can answer those four questions in half an hour handles this advisory as an evening task. An organisation that does not know who administers the appliance needs a week to reach the starting line, and that whole week is exposure.

This is precisely what the Essential Cybersecurity Controls issued by the National Cybersecurity Authority ask for in their vulnerability management domain: periodic vulnerability assessment and detection, classification by severity, remediation according to that classification and the associated risk, subscription to trusted sources for news of new vulnerabilities, and patch management that verifies the integrity and effectiveness of updates in a non-production environment before applying them. The control that usually fails is not patching itself. It is the trusted source: an organisation that never receives the vendor advisory learns about it from a news article days later, or never learns at all.

The Origami view

We build business systems rather than sell network hardware, and we still see the consequences of this in every integration project. Each time we connect a new system to a client network the same question surfaces: who grants permissions here, and where is that decision recorded. The recurring observation is that the fragile part is rarely the new application or its hardening. It is the layer the application assumes is correct and nobody inspects, because it is old and has been running quietly for years.

So we treat any component in the identity path as part of application security rather than adjacent to it. It is recorded in the asset list with its name, version and owner. It gets a maintenance window agreed in advance, instead of one improvised on the day an advisory lands. And its management interface is restricted to a separate administration network rather than reachable from the general one. Those are three practices that need no new budget, and they are the difference between a business that reads Cisco's advisory and knows what to do, and one that reads it and starts by asking who has the appliance password. It is part of how we work across our services.

Five questions to answer this week

This is not a complete security programme. It is five answers that reveal your readiness for the next advisory, because there will be a next advisory.

• If you run Cisco ISE or ISE-PIC: what release are you on, and is it within 3.1 to 3.5? If so, the fixed releases are listed above, and this is urgent rather than scheduled work. Until the patch is applied, restrict access to the device with access control lists as the advisory describes.
• Asset list: do you have a written list of the authentication and access systems you operate, with their versions? If the answer lives in one person's head, it is not a list.
• Advisory feed: who in your organisation is subscribed to the security advisories of every vendor you use? That subscription is free and takes minutes, and its absence is usually the reason for delay rather than any shortage of tooling.
• Time to patch: how many hours or days passed between the last critical advisory you received and the patch being applied? Write the number down. That is your real metric, and it is more honest than any written plan.
• Management interfaces: are the admin consoles of your critical devices reachable from anywhere on the network, or only from a defined management network? Restricting access does not remove the vulnerability, but it turns a potentially internet-wide attack into one that first needs an internal foothold.

The practical conclusion is narrow. Vulnerabilities are not an exceptional accident that ambushes your business; they are a recurring event you can rehearse for. What separates an organisation that holds from one that stops is not the absence of the flaw, but the hours that pass between the fix being published and the fix being applied.

Sources

• Cisco security advisory — CVE-2026-76460 at CVSS 10.0, affected and fixed releases, confirmation of active exploitation and the absence of a workaround, published 16 September 2026.
• CISA Known Exploited Vulnerabilities catalogue — added 16 September 2026 with a due date of 19 September 2026.
• National Cybersecurity Authority — Essential Cybersecurity Controls, vulnerability management and patch management requirements.