# CVE-2026-76460: Cisco Identity Services Engine Software - Authentication Bypass

> Live exploitation tracking for CVE-2026-76460 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-76460

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Cisco Identity Services Engine Software, Cisco ISE Passive Identity Connector
- **Weaknesses:** CWE-648 (Incorrect Use of Privileged APIs)
- **Tags:** enterprise_software

## Description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

## CrowdSec analysis

[CVE-2026-76460](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-76460) is a critical authentication bypass vulnerability in Cisco Identity Services Engine Software and Cisco ISE Passive Identity Connector. An unauthenticated remote attacker could send a crafted request to an affected API endpoint to bypass the web-based management interface and gain unauthorized access to the device, potentially affecting its confidentiality, integrity, and availability.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-76460 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2026-76460 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target `/admin/API/mnt/Session/ActiveList` on Cisco Identity Services Engine. Exploitation attempts may send a request with a fabricated `APPSESSIONID` cookie to bypass authentication and access active-session data.

## Timeline

- 2026-09-16: CVE Published. CVE-2026-76460 is published to NVD.
- 2026-09-16: CISA KEV. CVE-2026-76460 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-09-19: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-10-24: Rule Released. CrowdSec releases a rule to detect CVE-2026-76460 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-76460 for the first time.

## References

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-76460.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-76460) follows observed exploitation activity for CVE-2026-76460. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.