Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Cisco ISE and ISE-PIC actively exploited authentication bypass (CVE-2026-76460)

Vulnerability
First reported
Last updated
Happening score
H score 51
3 unique sources, 4 articles

Summary

Hide ▲

Cisco ISE and Cisco ISE-PIC are facing CVE-2026-76460, a maximum-severity API authentication bypass that is actively exploited in the wild. The flaw lets remote attackers send a crafted request to an affected API endpoint and bypass the web-based management interface to gain unauthorized access. Cisco released fixed software, said there are no workarounds, and advised checking access.log plus network and firewall logs for signs of abuse. CISA added the CVE to the KEV Catalog and ordered federal agencies to patch within three days.

Related Happenings

Arista mitigation guidance for Arista VeloCloud Orchestrator compensating controls for CVE-2026-93952

Advisory/Mitigation
H score53 First: 22.09.2026 15:29 Last: 22.09.2026 15:29 Sources 1

About this happening: Arista issued temporary mitigation steps for exposed VeloCloud Orchestrator (VCO) deployments while a fixed release is pending, limiting the risk from actively exploited...

Open Happening

Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog ordered federal agencies to patch systems against CVE-2026-76460 for within

Public Sector Action
H score37 First: 17.09.2026 10:20 Last: 17.09.2026 10:20 Sources 1

How related: The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 16, 2026, added CVE-2026-76460 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the patches by September 19, 2026.

About this happening: CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to patch affected systems within three days after C...

Open Happening

Cisco Secure Email Gateway insufficient validation flaw (CVE-2026-76461)

Vulnerability
H score45 First: 15.09.2026 09:11 Last: 15.09.2026 09:11 Sources 1

About this happening: Cisco Secure Email Gateway devices are exposed to CVE-2026-76461, an actively exploited email-parsing flaw that can let an unauthenticated remote attacker execute...

Open Happening

CISA mitigation guidance for CISA Adds Cisco Secure FMC CVE-2026-20079 to KEV Sets Sept. 12 Deadline

Advisory/Mitigation
H score58 First: 10.09.2026 00:40 Last: 10.09.2026 00:40 Sources 1

How related: Cisco confirmed on September 9 that the vulnerability was being actively exploited, updating its advisory to say its Product Security Incident Response Team became aware of the attacks in August. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day.

About this happening: CISA added CVE-2026-20079 to the KEV catalog and gave Federal Civilian Executive Branch agencies a September 12, 2026 deadline to secure affected Cisco Secur...

Open Happening

SharkLoader loader activity deploying Cobalt Strike Beacon

Malware Activity
H score30 First: 26.06.2026 21:17 Last: 26.06.2026 21:17 Sources 1

About this happening: A newly observed SharkLoader malware operation is staging Cobalt Strike Beacon on compromised Windows hosts, expanding post-compromise control and persistence risk. The lo...

Open Happening

Timeline

  1. 17.09.2026 10:20 5 articles · 13d ago

    Cisco patches actively exploited CVE-2026-76460 in ISE and ISE-PIC

    Initial Disclosure

    Cisco released security updates for CVE-2026-76460 in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), a maximum-severity API authentication bypass that lets remote attackers send a crafted request to an affected API endpoint and gain unauthorized access by bypassing the web-based management interface. Cisco PSIRT said the vulnerability is actively exploited, shared indicators of compromise, advised checking access.log files and network/firewall logs, and recommended upgrading to a fixed software release because no workarounds exist. CISA added CVE-2026-76460 to the KEV Catalog and ordered federal agencies to patch within three days.

    Show sources
    Open in new tab