Cyber999 Advisories

1.0 Introduction

Recently, Cisco released security updates to address a critical authentication bypass vulnerability (CVE-2026-76460) in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has confirmed that it is being actively exploited as a zero-day.

2.0  Impact

Successful exploitation of the vulnerability, due to insufficient authentication control, could allow an attacker to gain unauthorised access to the affected device by sending a crafted request to an affected API endpoint, thereby bypassing the web-based management interface.

3.0  Affected Versions

4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review the following advisories and apply the necessary updates:

Immediate action (all Cisco ISE and ISE-PIC administrators):

1. Upgrade to the fixed release for your version as listed above. Cisco states that patching is the only full remediation.
2. If you cannot patch immediately, use iACLs so that only required management and control plane traffic can reach the device.
3. Review the access.log on every node in the deployment for suspicious usernames, and check network and firewall logs outside the device for unusual uploads or downloads.
4. If malicious activity is suspected, Cisco strongly recommends re-imaging the affected nodes and restoring from a configuration backup if needed.
5. Cisco also released other ISE fixes in its September 2026 Security Hardening Release, so review the related advisories and apply the fixes that apply to your deployment.

Kindly refer to the following URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5

Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:

E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my

4.0  References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-126/