Cisco ISE CVE-2026-76460 Auth Bypass Exploitation Attempt

Min Sakka@AlphaOmega

•updated Sep 17, 2026•1•0•15

Detects suspicious/unexpected usernames appearing in Cisco ISE access.log, consistent with exploitation of CVE-2026-76460, an unauthenticated REST API auth-bypass in Cisco ISE / ISE-PIC (CVSS 10.0, actively exploited, CISA KEV). Cisco's own guidance is to hunt access.log for usernames not present in the legitimate identity store; "dummyuser" is their published example artifact.