CVE-2026-76460

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Oct 7, 2026

Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-648

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Oct 7, 2026
Added to CISA KEV
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-764619.8A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attackeCVE-2026-764625.5A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an CVE-2026-764638.8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprCVE-2026-764649.6As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprCVE-2026-764659.8A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series SwiCVE-2026-764669.8A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network acceCVE-2026-764677.5As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprCVE-2026-764688.2As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprCVE-2026-764697.4As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprCVE-2026-76478.1The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due tCVE-2026-764708.8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprCVE-2026-764719.8A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with