CVE-2026-76447: Cisco ISE OCSP Auth Bypass Vulnerability

CVE-2026-76447 Overview

Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain a missing authentication vulnerability in the Online Certificate Status Protocol (OCSP) responder. An unauthenticated, remote attacker can send a crafted request to an affected device and force the OCSP responder to reload its certificate and key material on demand. The flaw is tracked under CWE-306: Missing Authentication for Critical Function and affects availability of the OCSP responder service. Cisco disclosed the issue in the Cisco Security Advisory: ISE Multi-Auth Bypass.

Critical Impact

Remote, unauthenticated attackers can repeatedly trigger administrative reloads of OCSP responder certificate and key material, degrading certificate validation services.

Affected Products

• Cisco Identity Services Engine (ISE)
• Cisco Identity Services Engine Passive Identity Connector (ISE-PIC)
• Cisco ISE OCSP responder component

Discovery Timeline

• 2026-09-16 - CVE-2026-76447 published to the National Vulnerability Database
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76447

Vulnerability Analysis

The vulnerability resides in a function exposed by the OCSP responder in Cisco ISE and Cisco ISE-PIC. The responder issues signed certificate status responses that downstream RADIUS, TACACS+, and 802.1X flows rely on for revocation checks. Because a specific administrative function lacks authentication controls, any network-reachable attacker can invoke it without credentials or user interaction. Successful invocation causes the OCSP responder to reload its certificate and key material, disrupting steady-state operations.

Repeated exploitation can produce a denial-of-service condition against certificate revocation checking. During each reload, in-flight OCSP transactions may fail, cascading into authentication failures for endpoints that depend on real-time revocation verification.

Root Cause

The root cause is missing authentication on a privileged operation within the OCSP responder [CWE-306]. The affected endpoint accepts a crafted request and performs an administrative action without verifying the identity or authorization of the caller. This violates the principle that certificate and key reload operations must be restricted to authenticated administrators.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker sends a crafted request to the OCSP responder interface on an affected Cisco ISE or ISE-PIC deployment. No privileges or user interaction are required, and the attack complexity is low. The impact is limited to availability of the OCSP responder; confidentiality and integrity are not directly affected.

No verified proof-of-concept code is publicly available at the time of publication. Consult the Cisco Security Advisory: ISE Multi-Auth Bypass for authoritative technical details.

Detection Methods for CVE-2026-76447

Indicators of Compromise

• Unexpected reload events for the OCSP responder service in Cisco ISE system logs.
• Repeated OCSP responder certificate and key material reload entries without matching administrator activity.
• Spikes in failed 802.1X, RADIUS, or TACACS+ authentications correlated with OCSP responder restarts.

Detection Strategies

• Monitor Cisco ISE application and system logs for anomalous OCSP responder reload messages sourced from non-administrative IPs.
• Correlate OCSP responder restart events with inbound network requests to the ISE management or PSN interfaces.
• Alert on high-frequency OCSP requests from single or clustered source addresses that precede reload events.

Monitoring Recommendations

• Forward Cisco ISE syslog to a centralized analytics platform and baseline normal OCSP reload frequency.
• Track authentication failure rates on network access devices for correlation with ISE OCSP disruptions.
• Review firewall and NetFlow telemetry for unexpected sources connecting to Cisco ISE OCSP responder endpoints.

How to Mitigate CVE-2026-76447

Immediate Actions Required

• Apply the fixed software release identified in the Cisco Security Advisory: ISE Multi-Auth Bypass.
• Restrict network reachability to Cisco ISE and ISE-PIC OCSP responder interfaces using access control lists.
• Confirm ISE deployment inventory, including standalone, primary, and secondary nodes, to ensure full coverage.

Patch Information

Cisco has published fixed software for affected releases of Cisco ISE and Cisco ISE-PIC. Refer to the vendor advisory for the specific fixed version applicable to your deployment train. No workaround fully substitutes for applying the vendor-supplied patch. Verify the upgrade in a staging environment before production rollout.

Workarounds

• Limit access to the OCSP responder interface to trusted management networks and known network access devices.
• Enforce infrastructure ACLs on upstream routers and firewalls to block untrusted sources from reaching ISE service ports.
• Monitor for and rate-limit anomalous OCSP request patterns at the network perimeter until patching is complete.

# Configuration example: restrict OCSP responder exposure at the network edge
# Replace <ISE_MGMT_NET> and <TRUSTED_ADMIN_NET> with your environment values

access-list ISE_OCSP_PROTECT extended permit tcp <TRUSTED_ADMIN_NET> <ISE_MGMT_NET> eq 2560
access-list ISE_OCSP_PROTECT extended deny   tcp any                 <ISE_MGMT_NET> eq 2560
access-list ISE_OCSP_PROTECT extended permit ip  any                 any

interface GigabitEthernet0/0
 access-group ISE_OCSP_PROTECT in