Executive Threat Intelligence: Enterprise Network Access Control at Risk
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency binding directive updating the Known Exploited Vulnerabilities (KEV) catalog with CVE-2026-76460, a maximum-severity vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Assigned a severity rating of CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), incident response telemetry indicates that nation-state intrusion sets and advanced persistent threat (APT) groups are actively exploiting the defect to bypass corporate 802.1X network admission controls and compromise core enterprise routing infrastructure.
Cisco ISE functions as the central policy decision point for enterprise identity and access management across campus, branch, and data center environments. It regulates network access for millions of corporate laptops, mobile devices, and IoT hardware via RADIUS, TACACS+, and TrustSec protocols. A compromise of the ISE policy engine allows attackers to assign administrative privileges to rogue network endpoints, silently grant unauthenticated devices entry into restricted VLANs, and intercept corporate communications.
Vulnerability Mechanics & API Authorization Failure (CWE-285)
The vulnerability is rooted in the implementation of the internal Open Virtual Appliance (OVA) provisioning and synchronization REST APIs exposed via the Cisco ISE web management listener (TCP port 9060 and port 8443):
Under normal administrative operation, privileged endpoints in the /ers/config/ and /api/v1/policy/ namespaces require a signed cryptographic token or valid HTTP Basic Authentication header verified against the ISE internal administrator database. However, a routing logic defect in the reverse proxy dispatch servlet fails to validate authorization headers on incoming HTTP requests containing an internal management routing header sequence:
POST /api/v1/policy/network-device-group/override HTTP/1.1
Host: ise-pan.enterprise-corp.com:9060
Content-Type: application/json
X-Cisco-ISE-Internal-Dispatch: 127.0.0.1:LOCAL_PROV_SERVICE
X-Forwarded-Privilege-Level: 15
{
"operation": "MODIFY_AUTHORIZATION_PROFILE",
"targetProfile": "Default_Quarantine_Profile",
"newDacl": "permit ip any any",
"assignedVlan": 100,
"bypassPostureCheck": true
}
When the dispatch servlet processes the request, the proxy misinterprets the X-Cisco-ISE-Internal-Dispatch header as an internal local inter-process communication (IPC) channel originating from the local host loopback interface. Bypassing the authentication layer, the controller processes the unauthenticated payload with full administrative system privileges, permitting arbitrary modification of network security profiles and Downloadable Access Control Lists (DACLs).
Adversary Campaign Context & Lateral Movement Telemetry
Security operations centers (SOCs) monitoring global enterprise networks have observed a structured intrusion sequence executed by threat actors weaponizing CVE-2026-76460:
- Initial Network Reconnaissance: Attackers perform stealth port scanning targeting TCP ports 9060, 8443, and 8905 across corporate management subnets to identify primary ISE Policy Administration Nodes (PAN).
- Policy Tampering & DACL Modification: Adversaries modify the default Quarantine and Guest DACLs to
permit ip any any, instantaneously neutralizing automated posture checking and device isolation. - Rogue Endpoint Admission: The attacker registers rogue MAC addresses with trusted endpoint identity groups (such as
Domain_Controllers_GrouporExecutive_Workstations), allowing unmanaged attacker hardware to connect directly to sensitive enterprise switch ports. - TACACS+ Credential Harvesting: Threat actors query the ISE internal database to dump cached TACACS+ administrative credentials, enabling direct SSH access to core network routers and firewalls.
Affected Cisco ISE Software Releases
All standalone and distributed Cisco ISE and Cisco ISE-PIC deployments running the following software release trains are vulnerable prior to applying the corresponding patch release:
| Platform Product | Vulnerable Release Train | Remediation Software Release | Severity |
|---|---|---|---|
| Cisco ISE | 3.1 (all patch levels prior to Patch 9) | Cisco ISE 3.1 Patch 9 | Critical (CVSS 9.8) |
| Cisco ISE | 3.2 (all patch levels prior to Patch 7) | Cisco ISE 3.2 Patch 7 | Critical (CVSS 9.8) |
| Cisco ISE | 3.3 (all patch levels prior to Patch 3) | Cisco ISE 3.3 Patch 3 | Critical (CVSS 9.8) |
| Cisco ISE-PIC | 3.1, 3.2, 3.3 | Apply Matching Patch Release | Critical (CVSS 9.8) |
Defensive Playbook & Hardening Checklist
Network defense engineering teams operating Cisco ISE infrastructure must take immediate containment and verification actions:
1. Restrict Ingress Access to Policy Administration Nodes (PAN)
Under no circumstances should the ISE administrative web interfaces (ports 9060/TCP and 8443/TCP) be accessible from general workstation subnets or untrusted networks. Restrict management access exclusively to dedicated out-of-band jump hosts:
# Verify active interface IP access lists on Cisco Switch handling ISE PAN
interface GigabitEthernet1/0/24
description LINK_TO_CISCO_ISE_PAN
ip access-group RESTRICT_MGMT_INGRESS in
# Access-list restricting management ports 9060 and 8443 to Secure Bastion host
ip access-list extended RESTRICT_MGMT_INGRESS
permit tcp host 10.250.1.100 host 10.100.1.50 eq 9060
permit tcp host 10.250.1.100 host 10.100.1.50 eq 8443
permit udp any host 10.100.1.50 eq 1812
permit udp any host 10.100.1.50 eq 1813
deny tcp any host 10.100.1.50 eq 9060
deny tcp any host 10.100.1.50 eq 8443
permit ip any any2. Apply Software Maintenance Patches via ISE CLI
Download the official Cisco maintenance patch bundle and deploy it to the primary PAN followed by all secondary policy service nodes (PSNs):
# Copy patch bundle to local ISE repository
ise/admin# copy sftp://admin@bastion.corp/patches/ise-patchbundle-3.3.0.430-Patch3.SPA.x86_64.tar.gz repository corporate-repo
# Install patch on Primary Administration Node
ise/admin# application install ise-patchbundle-3.3.0.430-Patch3.SPA.x86_64.tar.gz corporate-repo
# Verify patch installation status
ise/admin# show version3. Audit Authorization Profiles and Active Sessions
Review all configured Authorization Profiles in the ISE WebUI under Policy > Policy Elements > Results > Authorization > Authorization Profiles to detect rogue DACL statements or unauthorized VLAN reassignment rules.
