Site icon TheCyberThrone

Cisco ISE and Secure Email Gateway Enter the KEV Spotlight

PravinKarthik
Advertisements

The latest Cisco security disclosures have put two enterprise security products under immediate scrutiny.

Cisco Identity Services Engine (ISE) and Cisco Secure Email Gateway are affected by vulnerabilities that have been associated with active exploitation and inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog.

The two vulnerabilities are:

While both vulnerabilities affect different security platforms, they share an important characteristic: the vulnerable systems sit in security-sensitive positions within enterprise environments.

Quick Reference

CVE-2026-76460

CVE-2026-76461

CVE-2026-76460 — Cisco ISE Authentication Bypass

Cisco disclosed CVE-2026-76460 on September 16, 2026.

The vulnerability exists in an API within Cisco Identity Services Engine. According to Cisco, insufficient authentication controls on an API endpoint can allow an unauthenticated remote attacker to bypass authentication.

An attacker can send a specially crafted request to the affected API endpoint. A successful attack can provide unauthorized access to the affected ISE device while bypassing the normal web-based management interface.

The vulnerability carries a CVSS 3.1 score of 10.0, with the following characteristics:

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This means exploitation is network reachable, requires low attack complexity, does not require prior privileges or user interaction, and can have high confidentiality, integrity and availability impact.

Why the API detail matters

One important point for vulnerability assessment is that this is not necessarily an API integration that an administrator explicitly configured.

Cisco describes the issue as a vulnerability in an API endpoint of ISE. Therefore, an organization should not automatically classify an affected ISE installation as safe simply because it does not use a particular external API integration.

More importantly, Cisco’s September 2026 ISE hardening advisory states that the affected ISE/ISE-PIC vulnerabilities covered by that release affect the products regardless of device configuration. Cisco provides fixed software rather than a configuration-based workaround.

For CVE-2026-76460 specifically, Cisco lists no workaround.

Fixed ISE releases

Cisco’s remediation guidance should be used to determine the appropriate fixed release for the installed ISE version.

For the September 2026 ISE security fixes, Cisco identifies:

Cisco also notes that ISE-PIC has reached end-of-sale and that 3.4 is its last supported release.

Organizations should validate the exact affected release against Cisco’s advisory before closing the vulnerability.

CVE-2026-76461 — Cisco Secure Email Gateway

The second vulnerability affects Cisco Secure Email Gateway, running Cisco AsyncOS.

CVE-2026-76461 is a SQL injection vulnerability in the email parsing functionality.

Cisco rates it CVSS 9.8 Critical.

The attack does not require authentication or user interaction.

An attacker can send a specially crafted email containing malicious SQL statements through an affected gateway. Cisco explains that successful exploitation can result in arbitrary SQL execution and ultimately command execution with root privileges on the underlying operating system.

This makes the vulnerability particularly significant because the attack path begins with the normal function of the product: processing email.

The Attack Path

At a high level, the exploitation chain looks like this:

Attacker

↓

Crafted email

↓

Cisco Secure Email Gateway

↓

AsyncOS email parsing

↓

SQL injection

↓

Command execution

↓

Root privileges

The vulnerability therefore does not depend on an attacker first obtaining administrative access to the appliance.

No Authentication. No User Interaction.

The CVSS characteristics are particularly important:

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In practical terms:

Cisco has published no workaround for CVE-2026-76461.

Active Exploitation Changes the Priority

The most important development is not simply the CVSS score.

Both vulnerabilities have appeared in the CISA Known Exploited Vulnerabilities catalog, indicating that they meet CISA’s criteria for vulnerabilities with evidence of exploitation.

CVE-2026-76460 was added to the KEV catalog on September 16, 2026.

CVE-2026-76461 was added following Cisco’s September 14 disclosure and is associated with confirmed exploitation.

This changes the operational question from:

“Is this vulnerability severe?”

to:

“Where do we have these products, and have they already been exploited?”

What Makes These Two Vulnerabilities Different?

Although both vulnerabilities affect Cisco security products, their exploitation mechanisms are fundamentally different.

Cisco ISE — Authentication Bypass

The attacker targets an affected API endpoint.

The objective is to bypass authentication and gain unauthorized access to the ISE device.

Primary concern:

Unauthorized access to a security and network-access-control platform.

Cisco Secure Email Gateway — SQL Injection

The attacker delivers a malicious email through the gateway.

The vulnerability exists in email parsing and can ultimately result in OS command execution with root privileges.

Primary concern:

Direct compromise of the email security appliance.

Configuration Is Not a Reliable Exclusion

One of the most important lessons from these Cisco disclosures is the difference between feature usage and product exposure.

For example:

“We don’t use the API.”

or

“That feature isn’t configured.”

does not automatically establish that the product is not vulnerable.

The correct vulnerability-management approach is to determine:

Product → Version → Vulnerable release → Vendor-defined exposure condition → Fixed release

Cisco’s advisories should remain the authoritative source for determining whether a particular release is affected.

For the September 2026 ISE hardening release, Cisco explicitly states that the vulnerabilities covered by that release affect ISE and ISE-PIC regardless of device configuration.

Similarly, the Secure Email Gateway vulnerability should not be treated as configuration-dependent merely because a particular email-processing feature is not intentionally used.

What Organizations Should Check

1. Identify the installed products

Search asset inventories for:

2. Determine exact versions

Do not stop at the product name.

Capture:

3. Compare against Cisco’s fixed releases

Use Cisco’s PSIRT advisories to establish whether the installed release is vulnerable and identify the appropriate fixed release.

4. Prioritize KEV exposure

Assets associated with either CVE should receive accelerated remediation because these vulnerabilities are associated with active exploitation.

5. Investigate before patching

Because exploitation has been reported, patching alone may not be sufficient.

Organizations should consider reviewing:

The objective is to determine whether exploitation occurred before remediation.

A Broader Security Lesson

These two vulnerabilities demonstrate two different ways that security infrastructure itself can become an attack surface.

CVE-2026-76460 targets the management/API layer of an identity and network-access-control platform.

CVE-2026-76461 targets the processing pipeline of an email-security appliance.

Neither requires the attacker to begin with legitimate credentials.

That is particularly important because security appliances frequently occupy trusted positions within enterprise architectures. Compromising one can provide an attacker with a strategically valuable foothold even when the appliance itself is not the organization’s primary business application.

Exit mobile version