Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
NVD: A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Hunt ISE access logs for suspicious usernames like dummyuser in ise-kong/access.log, especially HTTP requests to REST API endpoints that bypass authentication followed by root command execution or outbound connections from the ISE appliance
Research details
ComponentREST API authentication endpoint (API access control)
PreconditionsAttacker requires network access to the ISE web-based management interface (typically TCP 443/8443). No authentication is required; the vulnerability is due to insufficient authentication control on a REST API endpoint, allowing unauthenticated requests. ISE and ISE-PIC versions 3.1 through 3.5 are affected regardless of device configuration. agent
Exploit notesLow complexity — CVSS AC:L, unauthenticated, no user interaction. The Cisco PSIRT confirms active exploitation in the wild. Attackers send a crafted HTTP request to the affected API endpoint, bypass authentication on the web management interface, and gain root command execution. Post-exploitation, attackers can erase access logs to conceal activity. No public PoC has been published; exploitation details are based on the vendor advisory and IOCs.
SummaryA critical authentication bypass vulnerability in Cisco ISE REST API endpoints (CVSS 10.0, CWE-648) allows unauthenticated remote attackers to bypass the web management interface and gain root access. Cisco confirms active exploitation in the wild; the flaw was discovered via a TAC support case. Patches are available for ISE 3.1 through 3.5; no workarounds exist, only iACL mitigation.
Tia coverage
First reported2026-09-09
First exploit report2026-09-17
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.