SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76423

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Risk Signal Score35/100 — MITTEL
  • CVSS 10 — Kritisch
  • Weniger als 24 Stunden alt

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exploit could allow the attacker to read and modify ISE configuration and identity data with administrative privileges.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

let KnownIsePorts = dynamic([80, 443, 8443]); // Customize with actual ISE REST API ports
DeviceNetworkEvents
| where Action == "Allowed"
| where RemotePort in (KnownIsePorts)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName has_any ("java", "tomcat") // Common for REST API services
| where InitiatingProcessCommandLine has "http" or InitiatingProcessCommandLine has "rest"
| summarize count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend Anomaly = "Potential unauthenticated REST API access attempt"

Splunk SPL

sourcetype=cisco:ise:restapi (http_method=* OR uri_path=*rest*) (status=200 OR status=401) NOT (authentication_status=success)
| stats count by src_ip, dest_ip, dest_port, uri_path, http_method, authentication_status
| rename authentication_status as auth_status
| search auth_status!="success"
| eval Anomaly = "Potential unauthenticated REST API access attempt"

Sigma

title: Cisco ISE REST API Authentication Bypass Attempt
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a unique GUID
status: experimental
description: Detects potential attempts to bypass authentication on Cisco ISE REST API.
author: SecBoard
date: 2026/09/16
logsource:
  product: cisco
  service: ise
detection:
  selection:
    event_type: "rest_api_access"
    http_method: "*"
    uri_path|contains: "/rest/"
    authentication_status: "failed"
  condition: selection
level: high

Elastic ES|QL

from logs-cisco.ise.*
| where event.dataset == "ise.restapi"
| where http.request.method != null
| where url.path : "/rest/*"
| where http.response.status_code == 401 or http.response.status_code == 200
| where not (cisco.ise.authentication.status == "success")
| summarize count() by source.ip, destination.ip, destination.port, url.path, http.request.method, cisco.ise.authentication.status
| set anomaly = "Potential unauthenticated REST API access attempt"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen