Hunt the Cisco ISE login that never needed a password

You have seen this ticket. Nobody logged in, and yet something did. The ISE admin page looks normal, the nodes are up, and the only odd thing is an API call in the access log from a username your directory never issued. Cisco Identity Services Engine sits between your users and every network access decision they get. When that appliance answers an API that never required a valid admin session, investigate whether management access arrived without authentication, whether root followed, and whether credentials or crypto on the box still deserve trust.

CVE-2026-76460 illustrates why. Insufficient authentication control on an API endpoint in Cisco ISE and ISE Passive Identity Connector (ISE-PIC), any configuration, lets an unauthenticated remote attacker send a crafted request to an affected API and bypass the web-based management interface. Successful exploitation can lead to command execution as root. Cisco PSIRT became aware of active exploitation through a TAC case. CISA added it to KEV on 16 September 2026, with FCEB remediation expected by 19 September under BOD 26-04. Cisco Security Advisory CISA KEV alert SecurityWeek

For an ISE estate, the practical questions are:

• Which ISE and ISE-PIC nodes still run below the fixed patch for their branch, including every distributed node?

• Do ise-kong/access.log and support-bundle apigateway/access.log show suspicious usernames such as Cisco's dummyuser example?

• Did firewall, proxy, or netflow show unexpected uploads from the ISE management plane or downloads to it?

• What evidence supports re-imaging, renewing credentials and crypto, and restoring normal operation?

How the attack works

Management access should require a valid admin session

ISE is the NAC and identity enforcement chokepoint. Authenticity of "this is an API call" is not permission to skip the web-based management login. CVE-2026-76460 crosses that boundary: a crafted request to an affected API reaches unauthorized device access without a valid admin session, with root possible after that foothold.

Trusted chokepoint, untrusted authority

Successful exploitation hands the attacker the host that decides network access. Root can read policy and certificates, abuse credentials and crypto, and hide local evidence. Cisco pairs access-log review on every node with external network corroboration. Empty appliance logs after a root foothold are not clearance.

Risk: what root on ISE means for the company

Company risk is every ISE and ISE-PIC node: policy, certificates, network access decisions, and possible pivot from a trusted identity appliance. Do not invent SaaS IdP compromise as the scope of this CVE. Investigate management exposure, node count, credentials and crypto on the box, and unexpected egress or ingress involving management IPs. Start with ownership, cluster membership, and whether access logs and perimeter telemetry cover September 2026.

Mitigate Cisco ISE risk

Establish exposure and close the vulnerable path

There are no workarounds that fix the bug. Mitigation only: iACLs allowing only required management and control plane traffic destined to the device. Upgrade to a fixed release for the running branch:

Cisco ISE or ISE-PIC Release	First Fixed Release
3.1	3.1 Patch 12
3.2	3.2 Patch 11
3.3	3.3 Patch 12
3.4	3.4 Patch 7
3.5	3.5 Patch 4

ISE 3.0 has reached End of Software Maintenance. Migrate to a supported fixed release.

Preserve evidence, then restore when compromise is suspected

If malicious activity is suspected, Cisco strongly recommends re-imaging affected nodes and restoring from configuration backup if needed. Renew credentials and cryptographic materials as policy requires. Cross-check firewall, proxy, and netflow outside the appliance for unexpected uploads from the device or downloads to it.

Harden while and after you patch

Restrict management with iACLs; prefer external logging so a rooted box cannot be the only evidence store; inventory every node. Closure should record exposed versions, fixes, access-log and egress findings, and logging gaps.

How to hunt the activity

Reconstruct three stages: suspicious usernames in ISE access logs, unexpected management-plane network behavior, then version inventory.

Cisco became aware of exploitation in September 2026; advisory and KEV landed 16 September. Exact first-exploit day may be unclear. Use a conservative start such as datetime(2026-09-01) (or the advisory date) and expand earlier if needed; note when that start is an assumption. Retain timestamps, node identity, raw access-log lines, egress endpoints, and version.

Hunt in KQL

Suspicious usernames in forwarded ISE access logs. Assumes ise-kong/access.log or apigateway/access.log lines land in Syslog or a custom table. Cover every node.

let StartTime = datetime(2026-09-01);
Syslog
| where TimeGenerated >= StartTime
| where ProcessName has_any ("ise-kong", "apigateway", "ise")
    or SyslogMessage has_any ("ise-kong", "apigateway", "access.log")
| where SyslogMessage has "dummyuser"
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| order by TimeGenerated asc

Cisco's published, non-exhaustive example is show logging application ise-kong/access.log | include dummyuser on every node. Presence may indicate malicious activity. Expand only with analyst-approved usernames from your review, not reconstructed exploit request bodies. Support bundles with debug logs selected place additional access logs at ./ise/logs/apigateway/access.log (and rotated .gz).

Unexpected egress from or to the ISE management plane. Replace the example IPs.

let StartTime = datetime(2026-09-01);
let IseMgmtIPs = dynamic(["10.0.0.20", "203.0.113.20"]); // replace
CommonSecurityLog
| where TimeGenerated >= StartTime
| where SourceIP in (IseMgmtIPs) or DestinationIP in (IseMgmtIPs)
| where DeviceAction !in ("deny", "blocked", "drop")
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP,
    DestinationPort, Protocol, DeviceAction, RequestURL, Message
| order by TimeGenerated asc

Look for uploads from ISE management IPs to unexpected external destinations and downloads from hosts that are not normal update, DNS, or admin peers.

Version inventory. List ISE/ISE-PIC below the fixed patch for its branch from CMDB or UI/CLI export; include every distributed node.

Field mapping: Map fields against a known-good access-log line before trusting negatives.

False positives: Prefer Cisco's dummyuser example plus egress corroboration. Ordinary management traffic to update, DNS, or admin peers is not enough to escalate alone.

Empty results: Empty local access logs do not clear a rooted box. Empty SIEM results may mean missing forwarders, short retention, incomplete node coverage, or local wipe by root.

Hunt in Falcon CQL

Select the repo for ISE syslog/access-log forwards and firewall or proxy events. Same time window.

(#repo=YOUR_ISE_SYSLOG_REPO)
| @rawstring=/dummyuser/i
| table([@timestamp, @rawstring], limit=1000)

(#repo=YOUR_FIREWALL_REPO)
| (src.ip = "10.0.0.20" OR dst.ip = "10.0.0.20") // replace ISE mgmt IP
| table([@timestamp, src.ip, dst.ip, dst.port, action, @rawstring], limit=1000)

Field mapping: Expand host, action, and URL columns from your parser.

Empty results: Endpoint telemetry does not replace appliance access logs or perimeter egress. Same false-positive and empty-result caveats as KQL.

Hunt in Splunk

Replace indexes and ISE management IPs. Time picker from 1 September 2026 unless tighter.

index=YOUR_ISE_ACCESS_INDEX earliest=09/01/2026:00:00:00
| eval raw=coalesce(_raw, message, syslog_message)
| where match(raw, "(?i)dummyuser")
| table _time host sourcetype raw
| sort 0 _time

index=YOUR_FIREWALL_OR_PROXY_INDEX earliest=09/01/2026:00:00:00
| eval src=coalesce(src_ip, src, clientip)
| eval dest=coalesce(dest_ip, dest, destination)
| where src IN ("10.0.0.20", "203.0.113.20")
    OR dest IN ("10.0.0.20", "203.0.113.20")
| table _time host src dest dest_port action url
| sort 0 _time

Field mapping: Validate coalesce targets against known ISE and firewall events so username hits and egress can line up.

Empty results: Missing forwarders from a distributed node can look like a clean estate.

Hunt in Kibana

Discover time range from 2026-09-01 unless tighter:

(message: *dummyuser* OR syslog.message: *dummyuser*)
AND (host.name: *ise* OR host.hostname: *ise* OR log.file.path: (*ise-kong* OR *apigateway*))

(source.ip: ("10.0.0.20" OR "203.0.113.20") OR destination.ip: ("10.0.0.20" OR "203.0.113.20"))
AND NOT event.action: (deny OR blocked OR drop)

Columns: @timestamp, host.name, message or syslog.message, source.ip, destination.ip, destination.port, event.action. Verify a known access-log line per node before treating emptiness as clearance.

Interpret the results before escalating

A matching username shows a string appeared in API gateway processing. Additional evidence determines its meaning.

Finding	Next investigative step
dummyuser (or other suspicious username) in ise-kong/access.log	Identify node and adjacent lines; preserve evidence; check egress.
Hit only in support-bundle apigateway/access.log	Same triage; include rotated .gz; cover every node.
Unexpected upload from ISE mgmt IP or download to it	Correlate to the access-log window; check if the peer is a normal update, DNS, or admin host.
ISE/ISE-PIC below fixed patch for branch	Patch or migrate per Cisco's table; hunt the pre-upgrade window.
Empty local access logs after suspected root	Do not clear; rely on firewall/proxy/netflow and forensic preservation.
Empty SIEM searches	Validate forwarding from every node, field names, and retention before closing.

Avoid escalating solely on an old version, a lone username without context, or ordinary management traffic to update peers. Empty may mean no activity, missing collection, local wipe by root, different fields, or retention that misses the window.

Sources

• Cisco Security Advisory: Cisco Identity Services Engine Authentication Bypass Vulnerability (cisco-sa-ISE-ABP-VNSW7Tn5) (2026-09-16)

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-76460) (2026-09-16)

• SecurityWeek: Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day (2026-09-17)

What This Means for Your Team

The durable detection opportunity is a trusted identity appliance exercising management authority that an unauthenticated API call should never have granted: a bypass that reaches the management plane, possible root on the node, then network behavior that local logs alone may no longer show.

Apply that reasoning beyond this CVE: establish what ISE is allowed to do as infrastructure, identify the access-log and egress actions it actually performed, and investigate the mismatch. Then follow the consequences into credentials, crypto materials, configuration, and adjacent systems that trusted the NAC edge.

For teams using Microsoft Sentinel and Defender, Inception Security can help connect those investigative questions to the telemetry already available. An Inception Foresight M365 Assessment can help identify visibility and detection gaps that affect that work.

Inception Protection

Inception Protection is Inception Security's MDR on the Defender and Sentinel stack you already pay for. For Cisco ISE cases we help connect access-log and syslog hunts to perimeter egress, version inventory across every node, and the containment steps that restore trust in the appliance.

Inception Foresight

Want a clearer view of visibility and detection gaps on the Microsoft stack that affect investigations like this? Grab our free Inception Foresight M365 Assessment. No strings. Follow Inception Security on LinkedIn and @inceptionsec on X.