CISCO: 🗓️ Calendar 📅 Sep 16, 2026

CISCO Security Advisory

Published Date: Not specified

CVE: CVE-2026-76423

Advisory Summary

• bypass authentication to the REST API
• achieve remote code execution (RCE)
• conduct SQL injection
• perform XML External Entity (XXE) injection

• unauthorized access policy manipulation
• compromise of authentication/authorization trust boundaries
• downstream impact on connected network and endpoint security controls

• No workarounds are provided—mitigation depends on upgrading to fixed software
• The REST API authentication bypass + RCE combination implies high likelihood of full system compromise if reachable
• Treat any exposed management/REST endpoints as potential attack surfaces until patched

• CVE-2026-76423
• CVE-2026-76424
• CVE-2026-76425
• CVE-2026-76426
• CVE-2026-76427
• CVE-2026-76428

🛡️ Actionable guidance (do now)
1. Identify affected deployments of Cisco ISE and ISE-PIC across all environments (including passive/segmented deployments).
2. Check Cisco’s fixed releases referenced in the advisory and plan rapid patching (given Critical severity and no workarounds).
3. Restrict exposure: ensure REST/API endpoints and management interfaces are not reachable from untrusted networks (tight firewalling, segmentation, allowlists).
4. Validate compensating controls post-update: confirm patch level, re-test API access controls, and review logs for anomalous REST/API calls and exploit-like payload patterns.
5. Hunt for indicators around SQL/XXE payload behavior and any unexpected process creation consistent with RCE attempts.

📌

Reference: Vendor Advisory