10.0
Critique
Exploitée
CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-648
Description
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco Identity Services Engine Software | 3.5.0 | Pas de correctif indiqué |
| Cisco Identity Services Engine Software | 3.4.0 | Pas de correctif indiqué |
| Cisco ISE Passive Identity Connector | 3.5.0 | Pas de correctif indiqué |
| Cisco ISE Passive Identity Connector | 3.4.0 | Pas de correctif indiqué |
Références
- cisco-sa-ISE-ABP-VNSW7Tn5 sec.cloudapps.cisco.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Cisco Identity Services Engine Software
Les 199 CVE de Cisco Identity Services Engine Software →
CVE-2026-20241
Cisco Identity Services Engine Authorization Bypass Vulnerability
5.3
Moyenne
CVE-2026-76426
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to…
4.9
Moyenne
CVE-2026-76431
A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC…
4.9
Moyenne
CVE-2026-76427
A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to…
4.9
Moyenne