VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 13:03 UTC

CVE-2026-76460

Read full description

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.9/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 10: +1.50
Fresh EPSS: 75.60%: +0.38

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 25 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Infosecurity Magazine

Press · 01 Oct 2026, 07:00 · Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation - Infosecurity Magazine

SC Media

Press · 30 Sep 2026, 07:00 · Stop patching by score – and start patching by authority - SC Media

shattered.io

Press · 24 Sep 2026, 07:00 · Cisco ISE CVE-2026-76460: CVSS 10.0 Auth Bypass - shattered.io

Check Point Research

Press · 22 Sep 2026, 07:00 · 21st September – Threat Intelligence Report - Check Point Research

https://tech-insider.org/

Press · 22 Sep 2026, 07:00 · Cisco ISE Zero-Day CVE-2026-76460: CVSS 10.0 Patch - https://tech-insider.org/

See all 25 source documents

The Hacker News

Press · 21 Sep 2026, 07:00 · ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks - The Hacker News

Help Net Security

Press · 20 Sep 2026, 07:00 · Week in review: Cisco patches exploited email gateway 0-day, Revolut breach - Help Net Security

Dark Reading

Press · 18 Sep 2026, 07:00 · Cisco Zero-Day Highlights API Endpoint Authentication Issues - Dark Reading

Rescana

Press · 18 Sep 2026, 07:00 · Active Exploitation Alert: Cisco Identity Services Engine Authentication Bypass (CVE-2026-76460) Added to CISA KEV — Unauthenticated API Bypass to Root on ISE - Rescana

Techzine Global

Press · 18 Sep 2026, 07:00 · Cisco patches ISE vulnerability that is already being actively exploited - Techzine Global

SOCRadar

Press · 17 Sep 2026, 07:00 · CVE-2026-76460: Cisco ISE Flaw Actively Exploited - SOCRadar

SOC Prime

Press · 17 Sep 2026, 07:00 · CVE-2026-76460: Cisco ISE Zero-Day Exploited - SOC Prime

The Hacker News

Press · 17 Sep 2026, 07:00 · Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks - The Hacker News

Infosecurity Magazine

Press · 17 Sep 2026, 07:00 · Cisco Warns of Active Exploitation of Critical ISE Flaw - Infosecurity Magazine

Help Net Security

Press · 17 Sep 2026, 07:00 · Unauthenticated attackers are bypassing Cisco ISE's management interface (CVE-2026-76460) - Help Net Security

SecurityWeek

Press · 17 Sep 2026, 07:00 · Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day - SecurityWeek

Bitsight

Press · 17 Sep 2026, 07:00 · CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation - Bitsight

BleepingComputer

Press · 17 Sep 2026, 07:00 · Cisco warns of max severity ISE zero-day exploited in attacks - BleepingComputer

The Register

Press · 17 Sep 2026, 07:00 · Cisco drops another exploited zero-day, this time a perfect 10 - The Register

CSO Online

Press · 17 Sep 2026, 07:00 · Cisco patches max-severity ISE flaw, the second critical zero-day this week - CSO Online

CyberScoop

Press · 17 Sep 2026, 07:00 · Cisco alerts customers to second actively exploited zero-day in as many days - CyberScoop

The Cyber Express

Press · 16 Sep 2026, 07:00 · Cisco Patches Critical ISE Flaw CVE-2026-76460 Under Attack - The Cyber Express

Forkast News

Press · 16 Sep 2026, 07:00 · The Gatekeeper Is the Door: Cisco ISE’s Nine-CVE Disclosure and the Identity Infrastructure Attack Surface - Forkast News

The Cyber Express

Press · 16 Sep 2026, 07:00 · Cisco Patches Critical ISE Flaw CVE-2026-76460 Under Attack - The Cyber Express

Recorded Future

Press · 13 Sep 2026, 07:00 · September 2026 CVE Landscape - Recorded Future

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.9 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 10; EPSS 75.6%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:25.177862+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

13 Sep 2026, 07:00

Added to the CISA KEV catalog

16 Sep 2026, 00:00

Published

16 Sep 2026, 20:12

Latest press mention

01 Oct 2026, 07:00

Score calculated

05 Nov 2026, 14:00