CVE-2026-76423 in Identity Services Engine
Summary
by MITRE • 09/16/2026
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device.
This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exploit could allow the attacker to read and modify ISE configuration and identity data with administrative privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified security flaw resides within the Representational State Transfer application programming interface implementation of Cisco Identity Services Engine and its associated Policy Information Card components, presenting a critical risk to network infrastructure integrity. This vulnerability stems from an insufficient authorization check mechanism embedded in the web service layer that handles incoming HTTP requests. Under normal operational parameters, any interaction with administrative functions via this API should require valid authentication credentials and appropriate role-based access controls to verify the requester's identity and permissions before executing commands or accessing sensitive data stores. However, due to a logical error in the validation sequence, the system fails to enforce these security boundaries for specific endpoints, effectively leaving them accessible without prior verification of user privileges.
An unauthenticated remote attacker can leverage this deficiency by constructing and transmitting specially crafted HTTP requests directly to the exposed REST API port over the network. The exploit does not require any form of authentication token or session cookie because the underlying service logic bypasses the standard access control lists that typically govern administrative operations. By targeting specific endpoints associated with configuration management and identity data retrieval, an attacker can successfully interact with the system as if they possessed full administrator rights. This capability allows for both read and write operations on critical system parameters, meaning the scope of impact extends beyond mere information disclosure to include active modification of security policies and network configurations.
The operational impact of this vulnerability is severe, potentially leading to a complete compromise of the affected Identity Services Engine deployment. Since Cisco ISE serves as a central point for authentication, authorization, and accounting in many enterprise environments, gaining administrative access allows an attacker to alter firewall rules, modify user permissions, or disable security monitoring features. This can facilitate further lateral movement within the network, enable unauthorized access to protected resources, or result in service denial by disrupting critical identity services. The ability to read configuration data also exposes sensitive architectural details and credential hashes that could be used for additional attacks against other systems relying on the compromised ISE instance for authentication validation.
To mitigate this risk, immediate action is required to restrict network-level access to the REST API ports associated with Cisco ISE administrative functions. Organizations should implement strict firewall rules or access control lists that limit connectivity to these endpoints exclusively from trusted management networks and authorized IP addresses, thereby preventing exposure to untrusted external networks where potential attackers reside. Additionally, ensuring that all software components are updated to the latest vendor-recommended versions is essential, as Cisco has released patches addressing this specific authorization bypass flaw. Security teams should also audit existing API configurations to ensure that no other endpoints have been inadvertently exposed with similar permission levels and verify that multi-factor authentication is enforced for any remaining administrative interfaces.
From a classification perspective, this vulnerability aligns closely with Common Weakness Enumeration identifier CWE-287, which describes Improper Authentication, specifically relating to the failure of an actor to prove its identity before being granted access. Furthermore, in terms of tactical execution within the MITRE ATT&CK framework, this flaw facilitates Initial Access and Privilege Escalation techniques by allowing an unauthenticated user to assume a high-privileged role without valid credentials. The exploitation method corresponds to remote code execution patterns where input manipulation leads to unauthorized state changes on the target system. Continuous monitoring of API traffic for anomalous request patterns can aid in detecting attempted exploits, while regular vulnerability scanning should be employed to identify any instances of this misconfiguration across the enterprise environment before malicious actors can capitalize on it.