Full Report
AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460
Analysis Summary
# Vulnerability: Multiple Critical Flaws in Cisco ISE and ISE-PIC
## CVE Details
- **CVE ID:** CVE-2026-20192, CVE-2026-76423, CVE-2026-76460
- **CVSS Score:** Not explicitly provided in source (Critical/High inferred by impact)
- **CWE:**
- CWE-284 (Improper Access Control) - CVE-2026-20192
- CWE-290 (Authentication Bypass by Spoofing) - CVE-2026-76423
- CWE-648 (Incorrect Use of Privileged APIs) - CVE-2026-76460
## Affected Systems
- **Products:** Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC).
- **Versions:**
- All releases prior to 3.0
- Release 3.1
- Release 3.2
- Release 3.3
- Release 3.4
- Release 3.5
- **Configurations:** Systems utilizing the web-based management interface or administrative APIs.
## Vulnerability Description
This advisory covers three distinct flaws that allow for the compromise of identity services:
1. **CVE-2026-20192:** Improper access control that permits unauthenticated attackers to bypass security measures, modify configurations, and access sensitive data.
2. **CVE-2026-76423:** A spoofing vulnerability that enables an attacker to assume administrative privileges, allowing for full read/write access to ISE configuration and identity data.
3. **CVE-2026-76460:** A flaw in how the system handles privileged APIs, allowing attackers to bypass the standard web-based management interface for unauthorized access.
## Exploitation
- **Status:** **Exploited in the wild** (specifically CVE-2026-76460, added to CISA KEV on Sept 16, 2026).
- **Complexity:** Low (Inferred from "unauthenticated" bypass capabilities).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Access to sensitive identity data and system configurations).
- **Integrity:** High (Modification of system configurations and identity records).
- **Availability:** High (Potential to impact system availability).
## Remediation
### Patches
Cisco recommends upgrading to the following fixed versions:
- **3.1:** Update to 3.1 Patch 12
- **3.2:** Update to 3.2 Patch 11
- **3.3:** Update to 3.3 Patch 12
- **3.4:** Update to 3.4 Patch 7
- **3.5:** Update to 3.5 Patch 4
- **Prior to 3.0:** No direct patch; must migrate to a supported fixed release.
### Workarounds
- No specific workarounds were provided in the summary text. Immediate patching is the recommended course of action, particularly for CVE-2026-76460.
## Detection
- **Indicators of Compromise:** Review access logs for suspicious usernames or unauthorized administrative activity.
- **Detection methods:** Monitor for unusual API calls and unexpected logins to the web-based management interface.
## References
- **Vendor Advisory:** hxxps://www[.]cyber[.]gc[.]ca/en/alerts-advisories/al26-021-vulnerabilities-impacting-cisco-identity-services-engine-ise-cisco-ise-passive-identity-connector-ise-pic-cve-2026-20192-cve-2026-76423-cve-2026-76460
- **CISA KEV Catalog:** hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460
- **CWE Definitions:** hxxps://cwe[.]mitre[.]org/data/definitions/284.html, hxxps://cwe[.]mitre[.]org/data/definitions/290.html, hxxps://cwe[.]mitre[.]org/data/definitions/648.html