Cisco Identity Services Engine Privileged APIs Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-76460 to the Known Exploited Vulnerabilities Catalog on 16 September 2026 (catalog version 2026.10.21). The record describes an incorrect use of privileged APIs vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. CISA's remediation due date for federal civilian agencies is 19 September 2026. The record names no fixed version; CISA's required action is to apply mitigations in accordance with vendor instructions, consistent with BOD 26-04. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.140 probability of exploitation (97th percentile, 2026-10-23). CISA's ADP assesses the vulnerability as actively exploited, automatable, and total in impact.

Assessment

For a platform or AI-stack owner, the record lets you check whether Cisco ISE or ISE-PIC is in your estate and whether the vendor mitigations CISA directs have been applied. Because the record names no fixed version, the decision is to isolate affected devices or apply the vendor advisory's mitigations before the web-based management interface is reachable from an untrusted network.

For a cyber underwriter, the record lets you price or condition coverage on whether an insured runs Cisco ISE or ISE-PIC and has applied the vendor mitigations CISA directs. CISA's ADP assesses the vulnerability as actively exploited, automatable, and total in impact, which supports requiring a control — confirmation of patching or network isolation — before binding or renewing.

What would change this call

A vendor advisory naming a fixed version for CVE-2026-76460 would change the remediation guidance from applying mitigations to upgrading to the fixed version.

What to check next

Confidence

Filed 25 October 2026 from the record dated 16 September 2026.

Sources

[1] Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-76460

[2] CVE record CVE-2026-76460 — https://www.cve.org/CVERecord?id=CVE-2026-76460

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog