https://vulnerability.circl.lu/sightings/feed 2026-10-03T23:48:27.361436+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d760329b-3d05-4f2c-b77c-9c259fe8e51a/export 2026-10-03T23:48:27.384999+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d760329b-3d05-4f2c-b77c-9c259fe8e51a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76461", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwqotdujfw2z", "content": "Critical Cisco zero-days in Email Gateway & Firewall Center under active exploit\u2014patch now! #Cisco #ZeroDay #InfoSec #CVE-2026-76461 #CVE-2026-20079 #FirewallSecurity https://thedailytechfeed.com/cisco-confirms-multiple-zero-days-actively-exploited-in-email-gateway-firewall-tools/", "creation_timestamp": "2026-09-30T15:46:10.508085Z"} 2026-09-30T15:46:10.508085+00:00 https://vulnerability.circl.lu/sighting/2edb3557-9c83-4529-b12d-77dce675f831/export 2026-10-03T23:48:27.387222+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2edb3557-9c83-4529-b12d-77dce675f831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwn2gwgeg72l", "content": "Daily IT Security Digest \u2014 2026-09-29\n(CVE-2026-76460)**\nA critical authentication bypass vulnerability in Cisco Identity Services Engine (ISE and ISE-PIC) versions 3.1 through 3.5 allows remote attackers to gain administrative access via crafted API requests. No workaround exists \u2014 only patching", "creation_timestamp": "2026-09-29T05:03:18.404219Z"} 2026-09-29T05:03:18.404219+00:00 https://vulnerability.circl.lu/sighting/b58e0c96-0f27-4f51-9dbb-a2435ee4c3cc/export 2026-10-03T23:48:27.387376+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b58e0c96-0f27-4f51-9dbb-a2435ee4c3cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwlngkbh6f2b", "content": "Daily IT Security Digest \u2014 2026-09-28\nwarned of CVE-2026-76460, a critical authentication bypass in Cisco ISE and ISE-PIC (versions 3.1\u20133.5) that is being actively exploited. Remote attackers can gain administrative access via crafted API requests with no known workarounds. Organizations must patch", "creation_timestamp": "2026-09-28T15:37:46.986649Z"} 2026-09-28T15:37:46.986649+00:00 https://vulnerability.circl.lu/sighting/930b24a9-94d8-4c4f-acb4-06116996f776/export 2026-10-03T23:48:27.387504+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "930b24a9-94d8-4c4f-acb4-06116996f776", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://gist.github.com/alon710/6fbdcd66c8e5922d400df93b5e68cc40", "content": "# CVE-2026-76460: CVE-2026-76460: Cisco Identity Services Engine Authentication Bypass Vulnerability\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76460\n\n## Summary\nOn September 16, 2026, Cisco disclosed a critical authentication bypass vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This vulnerability allows unauthenticated, remote attackers to bypass the administrative interface controls and execute privileged API requests. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to the Known Exploited Vulnerabilities (KEV) Catalog with an immediate remediation deadline.\n\n## TL;DR\nA critical vulnerability in Cisco ISE (CVSS 10.0) allows remote, unauthenticated attackers to bypass authentication and gain full administrative control via crafted API requests.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-648\n- **Attack Vector**: Network\n- **CVSS Severity**: 10.0 (Critical)\n- **EPSS Score**: 0.14026\n- **Exploit Status**: Active Exploitation in the Wild\n- **CISA KEV Status**: Listed\n\n## Affected Systems\n\n- Cisco Identity Services Engine (ISE) Software\n- Cisco ISE Passive Identity Connector (ISE-PIC)\n- **Cisco Identity Services Engine (ISE) Software**: 3.1.0 <= Patch 11 (Fixed in: `3.1.0 Patch 12`)\n- **Cisco Identity Services Engine (ISE) Software**: 3.2.0 <= Patch 10 (Fixed in: `3.2.0 Patch 11`)\n- **Cisco Identity Services Engine (ISE) Software**: 3.3.0 <= Patch 11 (Fixed in: `3.3.0 Patch 12`)\n- **Cisco Identity Services Engine (ISE) Software**: 3.4.0 <= Patch 6 (Fixed in: `3.4.0 Patch 7`)\n- **Cisco Identity Services Engine (ISE) Software**: 3.5.0 <= Patch 3 (Fixed in: `3.5.0 Patch 4`)\n\n## Mitigation\n\n- Install official Cisco software patches immediately.\n- Restrict administrative access to Cisco ISE management interfaces to specific trusted administrative subnets.\n- Implement persistent log monitoring for unauthenticated access patterns on administrative API paths.\n\n**Remediation Steps:**\n1. Locate all Cisco ISE and Cisco ISE-PIC deployments across the network.\n2. Verify the current software version and patch level of each node.\n3. Acquire the appropriate software update patch from the Cisco Software Center.\n4. Apply the patch during a scheduled maintenance window.\n5. Review system logs post-remediation to confirm that unauthenticated API requests are rejected with a 401 Unauthorized response status.\n\n## References\n\n- [Cisco Security Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5)\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-76460)\n- [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-76460)\n- [Educational Proof-of-Concept (PoC) Laboratory](https://github.com/S3v3n-JG/CVE-2026-76460)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76460) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-28T14:00:32.000000Z"} 2026-09-28T14:00:32+00:00 https://vulnerability.circl.lu/sighting/422afe2a-1d45-47d5-8714-c14ca97ca481/export 2026-10-03T23:48:27.387656+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "422afe2a-1d45-47d5-8714-c14ca97ca481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwfixpukxq2d", "content": "Daily IT Security Digest \u2014 2026-09-26\n[Source](https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/)\n\n4. **Cisco ISE Critical Auth Bypass (CVE-2026-76460)**\n A critical authentication bypass vulnerability exists in Cisco Identity Services Engine (ISE) and", "creation_timestamp": "2026-09-26T05:01:56.149285Z"} 2026-09-26T05:01:56.149285+00:00 https://vulnerability.circl.lu/sighting/e7316bf5-008a-4626-bd4d-09a601938b2b/export 2026-10-03T23:48:27.387773+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e7316bf5-008a-4626-bd4d-09a601938b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwcyjli27i2x", "content": "Daily IT Security Digest \u2014 2026-09-25\nSIGABRT events.\n\nSource: [HackRead](https://hackread.com/f5-breach-so), [OffSeq](https://radar.offseq.com/threat/critical-f5-big-ip-apm-rce-zero-day)\n\n## 3. Cisco ISE Authentication Bypass \u2014 Actively Exploited Zero-Day (CVE-2026-76460)", "creation_timestamp": "2026-09-25T05:02:22.603368Z"} 2026-09-25T05:02:22.603368+00:00 https://vulnerability.circl.lu/sighting/a7ab826a-ff19-42cd-8fdb-30284a62389e/export 2026-10-03T23:48:27.387883+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a7ab826a-ff19-42cd-8fdb-30284a62389e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwbz3yslxf2u", "content": "Cisco ISE has a CVSS 10.0 unauthenticated API authentication bypass (CVE-2026-76460) granting root command execution on all supported versions, 3.1 to 3.51. Exploited in the wild before the patch, now on CISA KEV. Cisco says no workarounds, though iACLs may mitigate. Patch your NAC platform.", "creation_timestamp": "2026-09-24T19:42:36.360304Z"} 2026-09-24T19:42:36.360304+00:00 https://vulnerability.circl.lu/sighting/557366ca-f977-4628-bd78-94ad360599b8/export 2026-10-03T23:48:27.387997+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "557366ca-f977-4628-bd78-94ad360599b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwaxmx4u5b2w", "content": "(CISA TS-MAN) The Cyber Mind TSUITE Brief: CVE-2026-76460 \u2013 Cisco Identity Services Engine Incorrect Use of Privileged APIs\u00a0Vulnerability\n\nAnalyze the technical mechanics of CVE-2026-76460 with our Cisco TSUITE brief, covering Cisco ISE authentication bypass, path\u2026\n\nhttps://thecybermind.co/9ysa", "creation_timestamp": "2026-09-24T09:41:02.760813Z"} 2026-09-24T09:41:02.760813+00:00 https://vulnerability.circl.lu/sighting/c6ea1da2-5dc3-4814-afcb-42c245df76bf/export 2026-10-03T23:48:27.388108+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c6ea1da2-5dc3-4814-afcb-42c245df76bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwai2rxwgg2a", "content": "Daily IT Security Digest \u2014 2026-09-24\nfull control over WordPress installations. Operators of sites using this plugin should restrict form access or disable it until a full patch is available.\nhttps://stemshop.top/cve/CVE-2026-18467\n\n## 5. Actively Exploited Cisco ISE Auth Bypass (CVE-2026-76460)\nA", "creation_timestamp": "2026-09-24T05:02:27.126282Z"} 2026-09-24T05:02:27.126282+00:00 https://vulnerability.circl.lu/sighting/3117b852-a042-441e-b98d-9f2a537f9507/export 2026-10-03T23:48:27.388218+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3117b852-a042-441e-b98d-9f2a537f9507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76460", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mw7xuimxdm2d", "content": "The latest update for #BitSight includes \"Identity Risk: 5 Access Pathways Emerging Across Threat Intelligence\" and \"CVE-2026-76460: A critical Cisco ISE authentication bypass under active exploitation\".\n \n#Cybersecurity #RiskManagement https://opsmtrs.com/43KoF0t", "creation_timestamp": "2026-09-24T00:12:35.754985Z"} 2026-09-24T00:12:35.754985+00:00