CVE-2026-76444: Cisco ISE Information Disclosure Vulnerability

CVE-2026-76444 Overview

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain a missing authentication flaw in an internal service. The Policy Runtime Repository Table (PRRT) service does not require authentication for incoming requests. An unauthenticated remote attacker can send a crafted request to an affected device and retrieve sensitive configuration information. The weakness is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive configuration data from Cisco ISE and ISE-PIC deployments over the network without user interaction.

Affected Products

Cisco Identity Services Engine (ISE)
Cisco Identity Services Engine Passive Identity Connector (ISE-PIC)
Refer to the Cisco Security Advisory for the fixed release matrix

Discovery Timeline

2026-09-16 - CVE-2026-76444 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76444

Vulnerability Analysis

Cisco ISE is a policy management and network access control platform. ISE-PIC provides passive identity services derived from external identity providers. Both products expose an internal service known as the Policy Runtime Repository Table (PRRT), which handles runtime policy and configuration data.

The PRRT service accepts requests without enforcing authentication. An attacker who can reach the service over the network can query it directly and read back sensitive configuration information stored by the appliance. The disclosure is limited to confidentiality; the flaw does not modify data or affect availability of the appliance.

Root Cause

The root cause is missing authentication on a critical internal function [CWE-306]. The PRRT service was designed as an internal component but is reachable on the network without any credential, token, or session check. Any process that can establish a network connection to the listener can invoke the exposed operations.

Attack Vector

Exploitation is remote and requires no privileges or user interaction. An attacker sends a crafted request to the PRRT service endpoint on an affected ISE or ISE-PIC device. The service processes the request and returns configuration content. Cisco has not published a public proof-of-concept, and there is no evidence of exploitation in the wild.

Refer to the Cisco Security Advisory: Multi-auth Bypass for protocol-level detail.

Detection Methods for CVE-2026-76444

Indicators of Compromise

Unexpected inbound network connections to the PRRT service port on ISE or ISE-PIC nodes from untrusted sources.
Configuration data appearing in logs, exports, or third-party systems that was not initiated by a documented administrative workflow.
Repeated short-lived TCP sessions to internal ISE service ports originating from non-management subnets.

Detection Strategies

Baseline legitimate PRRT traffic between ISE nodes and alert on connections that originate outside the expected management or node-to-node network.
Review ISE application and system logs for anomalous internal service requests correlated with external source addresses.
Use network detection tooling to flag unauthenticated protocol exchanges targeting ISE administrative and internal service ports.

Monitoring Recommendations

Restrict monitoring scope to management-plane VLANs where ISE and ISE-PIC nodes reside and alert on east-west anomalies.
Forward ISE syslog and audit events to a centralized analytics platform for correlation with network flow data.
Track outbound traffic from ISE nodes to detect exfiltration attempts following successful information retrieval.

How to Mitigate CVE-2026-76444

Immediate Actions Required

Review the Cisco Security Advisory and identify affected ISE and ISE-PIC releases in your environment.
Apply the fixed software release published by Cisco to every ISE and ISE-PIC node, including primary, secondary, and PSN roles.
Restrict network access to ISE management and internal service interfaces so that only authorized administrative subnets and peer nodes can connect.
Audit ISE configuration for sensitive material such as shared secrets and rotate any values that could have been exposed.

Patch Information

Cisco provides fixed software through its standard security advisory channel. Consult the Cisco Security Advisory: Multi-auth Bypass for the specific fixed versions that address CVE-2026-76444 and follow the vendor's upgrade guidance for ISE deployments.

Workarounds

Cisco has not published a supported workaround; the recommended action is to install the fixed release.
As a compensating control, enforce network access control lists on upstream devices to limit reachability of ISE internal service ports to trusted hosts only.
Place ISE and ISE-PIC nodes on an isolated management network segment with strict ingress filtering until patching is complete.