CVE-2026-76423: Cisco ISE Authentication Bypass Vulnerability

CVE-2026-76423 Overview

CVE-2026-76423 is an authentication bypass vulnerability in the Representational State Transfer (REST) Application Programming Interface (API) of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw allows an unauthenticated, remote attacker to gain administrative access to affected devices by sending crafted HTTP requests to the exposed REST API port. Successful exploitation permits reading and modifying ISE configuration and identity data with administrative privileges. The vulnerability is tracked under [CWE-290] (Authentication Bypass by Spoofing).

Critical Impact
Unauthenticated remote attackers can obtain administrative control of Cisco ISE deployments, compromising network access control policies and identity data enterprise-wide.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco ISE Passive Identity Connector (ISE-PIC)
REST API web service component on affected releases

Discovery Timeline

2026-09-16 - CVE-2026-76423 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76423

Vulnerability Analysis

The vulnerability resides in the REST API web service exposed by Cisco ISE and ISE-PIC. The service accepts HTTP requests on its API port without enforcing sufficient authorization checks on privileged operations. An attacker who can reach the API port over the network can invoke administrative endpoints as if authenticated. This gives the attacker the ability to read sensitive configuration, modify identity stores, alter access policies, and manipulate authentication data used by downstream network devices.

Because Cisco ISE governs network access control, RADIUS/TACACS+ authentication, and endpoint posture across the enterprise, administrative compromise of ISE cascades to every device and identity that relies on it. The scope change reflected in the CVSS vector indicates that exploitation impacts resources beyond the vulnerable component itself.

Root Cause

The root cause is missing or insufficient authorization enforcement on the REST API service. Endpoints intended to be restricted to authenticated administrators are reachable without valid credentials, matching the [CWE-290] pattern of authentication bypass through spoofed or absent identity verification.

Attack Vector

Exploitation requires network reachability to the REST API port on an affected ISE or ISE-PIC node. The attacker sends a crafted HTTP request to an administrative endpoint. No user interaction, prior authentication, or elevated privileges are required. Successful requests return or modify data with administrative context.

No verified public proof-of-concept code is available at this time. Refer to the Cisco Security Advisory: ISE Vulnerability for authoritative technical details.

Detection Methods for CVE-2026-76423

Indicators of Compromise

Unexpected HTTP requests to Cisco ISE REST API endpoints from unusual source addresses or outside authorized management networks.
New or modified administrator accounts, network device entries, or authentication policies in ISE that do not match approved change records.
Configuration exports, identity store dumps, or bulk read operations against the API without a corresponding authenticated administrative session.
Anomalous RADIUS/TACACS+ policy changes correlating with API activity.

Detection Strategies

Inspect ISE application and audit logs for API calls that lack a preceding authentication event or originate from non-management subnets.
Baseline normal REST API usage patterns and alert on deviations in request volume, endpoint paths, or client identifiers.
Correlate ISE configuration change events with authenticated administrator sessions to surface changes attributable to unauthenticated calls.

Monitoring Recommendations

Forward ISE syslog, audit, and administrative-change events to a centralized logging or SIEM platform for retention and correlation.
Monitor network flows to ISE management interfaces for unauthorized clients attempting connections to REST API ports.
Track privileged operations, including policy edits, identity source modifications, and certificate changes, in near real time.

How to Mitigate CVE-2026-76423

Immediate Actions Required

Restrict network access to Cisco ISE and ISE-PIC management and API interfaces to a dedicated management network using access control lists and firewalls.
Apply the fixed software release identified in the Cisco Security Advisory: ISE Vulnerability as soon as it is available for your deployment.
Rotate administrative credentials, API tokens, and certificates on any ISE node that was reachable from untrusted networks.
Review ISE configuration, identity stores, and policy sets for unauthorized modifications and revert changes that cannot be attributed to approved activity.

Patch Information

Cisco has published guidance and fixed software information in the Cisco Security Advisory: ISE Vulnerability. Administrators should consult the advisory for the specific fixed release corresponding to their ISE or ISE-PIC train and upgrade affected nodes accordingly.

Workarounds

Limit exposure of the REST API port to trusted management hosts only, using upstream firewalls or infrastructure access control lists.
Place ISE administrative interfaces on an out-of-band management network isolated from user and server VLANs.
Disable or block external access to the REST API where it is not required for operational integrations.

bash

# Example upstream ACL restricting ISE REST API access to a management subnet
ip access-list extended ISE-API-RESTRICT
 permit tcp 10.10.0.0 0.0.0.255 host <ISE_NODE_IP> eq 443
 deny   tcp any host <ISE_NODE_IP> eq 443 log
 permit ip any any