Cisco Identity Services Engine Software - Authentication Bypass (CVE-2026-76460)

CVE-2026-76460 is a critical authentication bypass vulnerability in Cisco Identity Services Engine Software and Cisco ISE Passive Identity Connector. An unauthenticated remote attacker could send a crafted request to an affected API endpoint to bypass the web-based management interface and gain unauthorized access to the device, potentially affecting its confidentiality, integrity, and availability.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-76460 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2026-76460 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target /admin/API/mnt/Session/ActiveList on Cisco Identity Services Engine. Exploitation attempts may send a request with a fabricated APPSESSIONID cookie to bypass authentication and access active-session data.