Cisco ISE after 16 September: patch, upgrade from 3.1/3.2, rethink certificates

The 16 September vulnerability is the trigger, not the whole story. Anyone running Cisco ISE faces four dates in the same system: the security patch, the end of fixes for 3.1 and 3.2, the end of life of the appliances and a certificate change that can break pxGrid. We work through them in that order.

Now: patch and look for traces

Cisco describes CVE-2026-76460 briefly: a vulnerability in an API of ISE allows an unauthenticated, remote attacker to bypass authentication. It affects ISE and the ISE Passive Identity Connector (ISE-PIC) regardless of configuration. The CVSS score is 10.0, the Cisco PSIRT is aware of active exploitation, and there is no workaround. The US agency CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 16 September and gave US federal agencies until 19 September to act.

The patch closes the hole but does not show whether it was used before. The advisory lists the checks:

• On every node, search the application log ise-kong/access.log for suspicious usernames; additional access.log files are in a support bundle with debug logs.
• Check network and firewall logs outside ISE for unexpected uploads from ISE to external addresses and for downloads from malicious addresses.
• If compromise is suspected, re-image the affected nodes and restore from the configuration backup if needed.

On the same day Cisco published a hardening release for ISE and ISE-PIC. It groups internally discovered vulnerabilities under six CVE identifiers with CVSS scores between 6.5 and 10.0; for the one that is actively exploited, Cisco refers to the authentication bypass advisory. The first fixed patches are the same in both advisories.

ISE 3.1 and 3.2: fixes end on 3 November

Cisco announced the end of life of ISE 3.1 and 3.2 on 5 May 2025. The date that matters now is just under six weeks away.

The hardening advisory notes that the patches for 3.1 and 3.2 include only the critical fixes and advises migrating to a supported release with all hardening fixes. After 3 November 2026 no fixes are published at all: the next critical vulnerability would stay open on 3.1 and 3.2, even though service and support continue until 30 November 2027.

ISE-PIC has its own note in the hardening advisory: it has reached its end-of-sale date, and 3.4 is the last supported release.

1. 01

   Take stock

   Release, patch level, persona and appliance model per node — read from the system, not from the documentation.

2. 02

   Check path and hardware

   According to the release notes, a direct upgrade to 3.5 is possible only from 3.2, 3.3 or 3.4 — 3.1 needs an intermediate step. Beforehand, Cisco recommends the latest patch of the current release. Settle this before the schedule, not during it.

3. 03

   Test what you use

   802.1X and MAB, profiling, the guest portal, TACACS+ and pxGrid subscribers, in an environment where a fault costs nothing. The basics are in the article on 802.1X wired access control.

4. 04

   Cut over in stages

   With a backup of configuration and certificates including private keys, a defined way back and acceptance based on real authentications from the affected networks.

Appliances: SNS-36xx and SNS-37xx

Both older Secure Network Server generations are end-of-life; their last dates of support are a little over two years apart.

For the SNS-37xx one date is closer than the table suggests. 30 December 2026 is the end of software maintenance releases and the last day on which a new service contract can still be ordered for units without one. Cisco can still ship security fixes until 31 December 2030. For the SNS-36xx, maintenance releases already ended on 16 August 2024.

Certificates: public CAs drop clientAuth

The quietest of the four dates hits the services that connect ISE to other systems. According to Cisco Field Notice FN74392, since May 2026 many public CAs no longer issue TLS certificates with the Client Authentication extended key usage (EKU); new certificates typically carry Server Authentication only. The background is the Chrome Root Program: under its policy, certificates from Chrome Root Store hierarchies issued on or after 15 March 2027 may assert serverAuth only.

• pxGrid: below the patch levels in the table, ISE neither imports nor binds a renewed certificate that carries serverAuth only. The fix patches remove that restriction.
• ISE Messaging Service: from 3.4 P6 and 3.5 P3, ISE accepts serverAuth-only certificates here too, and Cisco recommends the ISE internal CA certificate at renewal. On 3.3 and earlier both EKUs remain mandatory, and the GUI does not prevent installing a certificate without both — the service then fails.
• TC-NAC: affected if the admin certificate carries serverAuth only and the connected vulnerability scanner enforces strict mTLS.

Certificates with both EKUs that public CAs issued before May 2026 are still honored until they expire, the field notice says. The grace period is short: under the CA/Browser Forum Baseline Requirements, a public TLS certificate issued on or after 15 March 2026 is valid for at most 200 days.

In practice this coincides with the security patch, which sits one patch number above the field notice level in every release. Use the same maintenance window to export the pxGrid, IMS and admin certificates and read out EKU, issuer and expiry. More on shorter lifetimes is in the article on certificate lifetimes.

Planning: maintenance windows on Cisco's calendar

Since July 2026 Cisco has reserved the first and third Wednesday of each month for security-hardened software publications; seven days ahead, the PSIRT names the technologies and platforms included. 16 September was a third Wednesday, and the ISE hardening advisory refers to Cisco's advance notification for that day. For security incidents, active exploitation and externally discovered zero-days, Cisco still works outside the cadence.

According to Cisco, this turns patch management into a planned activity rather than a fire drill. The ISE maintenance window can then follow the calendar, not the headline.

The order for the coming weeks, as a checklist:

• Security patch installed on all nodes: 3.1 P12, 3.2 P11, 3.3 P12, 3.4 P7 or 3.5 P4.
• ise-kong/access.log checked on all nodes and firewall logs outside ISE reviewed, result documented.
• Configuration backup and system certificates with private keys secured outside ISE.
• Upgrade target set (3.4 or 3.5, 3.4 for ISE-PIC), intermediate step for 3.1 planned.
• Appliance model recorded per node, 30 December 2026 noted for SNS-37xx without a contract.
• EKU, issuer and expiry of the pxGrid, IMS and admin certificates read out, private PKI for internal services planned.
• Maintenance windows aligned with the reserved Wednesdays, emergency path named.

How we patch, upgrade and operate ISE deployments is described in our ISE operations offering; introducing network access control is covered under NAC and 802.1X with Cisco ISE. If you want to sort out patch level, upgrade target and certificates in one session, talk to us about your ISE upgrade.