Cisco ISE REST API bypass scores 10.0 and grants admin without credentials

Cisco has patched a maximum-severity flaw in the REST API of its Identity Services Engine (ISE) platform that grants administrative control to any unauthenticated attacker able to reach the interface. The bug, tracked as CVE-2026-76423, carries a CVSS v3 base score of 10.0 and was disclosed in a set of Cisco security advisories published on 16 September 2026, according to a dev.to analysis of the release.

How the bypass works

ISE is the policy decision point for network access control, and its REST API is the surface administrators and automation tooling use to read and change identity records, policy sets and endpoint posture data. Per Cisco's advisory as summarised by dev.to, the root cause is that the REST API web service was exposed without adequate authorization checks. A crafted HTTP request to the affected endpoint is therefore processed without the caller proving an identity or holding a privileged role.

Because this is an authorization defect rather than a credential-handling bug, exploitation needs no password guessing, stolen tokens, valid accounts or client certificates. The only real precondition is IP-level reachability of the API. That interface normally sits on a management network rather than the public internet, but flat internal networks, permissive firewall rules, broadly scoped VPN access or accidental internet exposure all satisfy the requirement, and no user interaction is needed.

A cluster of critical ISE bugs

CVE-2026-76423 arrived alongside related issues in the same advisory cycle: CVE-2026-20130, an improper neutralization finding in the hardening release also scored 10.0; CVE-2026-20307, insecure deserialization enabling remote code execution at 9.9; CVE-2026-20305, command injection in diagnostic tooling at 9.1; and CVE-2026-20284, SQL injection in the SXP REST API, also rated 9.1.

Cisco stated it was not aware of malicious exploitation of these CVEs at disclosure time. The dev.to write-up, however, also references a CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-76423 dated the same day, which sits oddly beside Cisco's statement; both claims are reported here as the source presents them.

One disclosure detail stands out: the findings reportedly came from a mix of Cisco's established internal security testing and what the source describes as frontier AI models — a remark about how the bugs were found, not about attacks in progress.

Affected versions and fixes

The advisories cover Cisco Identity Services Engine and the ISE Passive Identity Connector, with releases 3.1, 3.2, 3.3, 3.4 and 3.5 impacted, and several of the issues applying to ISE-PIC across all device configurations. Fixed builds are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. Organisations on older branches should fold migration to a supported release into the remediation rather than treat it as a separate project.

There is no complete workaround. Cisco's guidance, as relayed by dev.to, is to apply infrastructure access control lists so that only trusted internal subnets can reach ISE management interfaces, keeping the REST API away from user VLANs and the internet entirely.

Scale of exposure

A ZoomEye query for the ISE product fingerprint returned 883,616 matching assets at the time of writing — a measure of how widely the product is deployed, not evidence that those instances run vulnerable code or expose their APIs. A query indexed against the CVE itself returned zero results, which is expected for a freshly published identifier and should not be read as an absence of affected deployments.

What administrators should do now

Beyond patching every node, including ISE-PIC instances, the write-up recommends treating any internet-facing ISE management interface as an emergency and auditing firewall and NAT rules for the appliance. Reviewing administrative audit logs and API access logs for requests that do not match a known account or automation job — and for configuration changes made outside change windows — is advised, followed by verification that the patched API rejects unauthenticated requests.

Why it matters

ISE sits at the centre of the trust boundary, so administrative compromise is not contained to a single host. An attacker with access to the API can read and alter identity and endpoint data, rewrite authorization policy to move endpoints into permissive sets or drop posture requirements, and change how switches and wireless controllers enforce access. Because ISE holds trust relationships with network infrastructure, it also serves as a pivot into the wider corporate network. A single missing authorization check on a management API undermines the very mechanism an organisation relies on to decide who and what may connect — and the clock on patching started on 16 September.