Multiple Vulnerabilities in Cisco Products (ISE, ISE-PIC, UCS Central, Unified CM/SME) - CVE-2026-20241, CVE-2026-76419, CVE-2026-76506

Key facts for Cisco ISE auth bypass

Detection coverage for Cisco ISE auth bypass

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5437 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unified CM Management URL XSS Payload (CVE-2026-76419) - Client-Side Exploitation / Lure

Splunk SPL detection for CVE-2026-76419 on Cisco Unified CM / SME. Cisco PSIRT reports no known exploitation at publication (2026-11-04); this is behavioural coverage of the advisory's described trigger, not a known exploit signature.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1059.007, T1203
• Data sources: cisco_cucm_web_access_logs, reverse_proxy_or_waf_access_logs, defender_for_office365_urlclickevents
• Severity: medium
• Confidence: medium

Splunk SPL

index=network sourcetype=access_combined (host=cucm* OR dest=cucm*) ```CVE-2026-76419 cisco-sa-cucm-xss-5mQn2U5z reflected XSS via crafted link to Unified CM web management interface``` (uri_path="/ccmadmin/*" OR uri_path="/ccmservice/*" OR uri_path="/cmplatform/*" OR uri_path="/ccmuser/*") (uri_query="*<script*" OR uri_query="*%3cscript*" OR uri_query="*javascript:*" OR uri_query="*onerror=*" OR uri_query="*onload=*" OR uri_query="*%3csvg*") | stats count values(uri_path) as paths values(http_referrer) as referrers min(_time) as first_seen max(_time) as last_seen by src_ip, user, dest | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | sort - count

Microsoft KQL

// CVE-2026-76419 - crafted XSS link to Unified CM / SME web management interface clicked by a user
UrlClickEvents
| where Timestamp > ago(24h)
| where Url has_any ("/ccmadmin/", "/ccmservice/", "/cmplatform/", "/ccmuser/")
| where Url has_any ("<script", "%3cscript", "javascript:", "onerror=", "onload=", "%3csvg")
| project Timestamp, AccountUpn, Url, IPAddress, ActionType, IsClickedThrough, NetworkMessageId
| order by Timestamp desc

Sigma

title: Cisco Unified CM Reflected XSS Payload in Management URL (CVE-2026-76419)
id: d41a9e85-67c3-4b0f-8e12-c5f3a7b90d36
status: experimental
description: Detects script-injection payloads in query strings sent to Cisco Unified CM / SME web management paths, consistent with a crafted link exploiting CVE-2026-76419.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.t1059.007
  - attack.t1203
  - cve.2026.76419
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/ccmadmin/'
      - '/ccmservice/'
      - '/cmplatform/'
      - '/ccmuser/'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3csvg'
  condition: selection_path and selection_payload
falsepositives:
  - Internal web application security testing against Unified CM
  - Rare legitimate parameters containing the string onload=
level: high

Known false positives:

• Internal application security testing of Unified CM
• Rare legitimate parameters containing onload= or javascript: strings

Tuning notes: Replace host=cucm* with Unified CM publisher and subscriber names, add payload strings seen in your environment, and prioritise hits whose referrer is an external or mail domain. For KQL, ensure Safe Links click telemetry is enabled.

• 🔒 ISE Unauthenticated Endpoint Certificate Request (CVE-2026-20241) - Exploitation · unlock with TL Creds
• 🔒 UCS Central Authenticated Traversal Request (CVE-2026-76506) - Post-Authentication Exploitation · unlock with TL Creds
• 🔒 Unified CM Management URL XSS Payload (CVE-2026-76419) - Client-Side Exploitation / Lure · unlock with TL Creds
• 🔒 ISE Unauthenticated Endpoint Certificate Request (CVE-2026-20241) - Exploitation · unlock with TL Creds
• 🔒 UCS Central Authenticated Traversal Request (CVE-2026-76506) - Post-Authentication Exploitation · unlock with TL Creds
• 🔒 Unified CM Management URL XSS Payload (CVE-2026-76419) - Client-Side Exploitation / Lure · unlock with TL Creds
• 🔒 ISE Unauthenticated Endpoint Certificate Request (CVE-2026-20241) - Exploitation · unlock with TL Creds
• 🔒 UCS Central Authenticated Traversal Request (CVE-2026-76506) - Post-Authentication Exploitation · unlock with TL Creds

Indicators of compromise for Cisco ISE auth bypass

As of 2026-11-06, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5437.

Sample indicators (3 of 12)

• URL: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ
• URL: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO
• URL: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

How Cisco ISE auth bypass works

GovCERT.HK alert A26-11-07 (5 Nov 2026) relays three Cisco security advisories published on 4 Nov 2026. Depending on the flaw, impact ranges from remote code execution to information disclosure and security restriction bypass.

CVE-2026-76506 (cisco-sa-cucs-rce-LzHSFRDQ, CVSS 7.6 High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, CWE-22) is a flaw in the web management interface of Cisco UCS Central Software. Insufficient input validation of HTTP requests lets an authenticated attacker with valid credentials execute arbitrary code or access sensitive data. No workarounds exist. Releases 2.0 and earlier are vulnerable and must migrate to a fixed release; release 2.1 is fixed in 2.1(2c). The issue was reported by Anand Murugan of Gulf Business Machines (GBM).

CVE-2026-20241 (cisco-sa-ise-cert-mE9BD5GO, CVSS 5.3 Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, CWE-285) is an authorization flaw in Cisco ISE and ISE-PIC that lets an unauthenticated remote attacker obtain an endpoint identity certificate through crafted requests. Fixed in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. No workarounds.

CVE-2026-76419 (cisco-sa-cucm-xss-5mQn2U5z, CVSS 6.1 Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79) is a cross-site scripting flaw in the web-based management interface of Cisco Unified CM and Unified CM SME releases 14 and 15. An unauthenticated attacker can persuade a user of the interface to click a crafted link and execute script in the interface context or access sensitive browser-based information. Release 14 must migrate to a fixed release; release 15 is fixed in 15SU5 and later. No workarounds.

Per Cisco, PSIRT is not aware of public announcements or malicious use of any of the three issues. No network or file IOCs have been published; the indicators recorded here are advisory, product and URL identifiers for tracking and patch-compliance purposes. The overall record severity follows the highest-rated CVE (CVE-2026-76506, 7.6).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Credential Access

T1649 Steal or Forge Authentication Certificates

Remediation for Cisco ISE auth bypass

Patches

• UCS Central: upgrade release 2.1 to 2.1(2c); release 2.0 and earlier must migrate to a fixed release
• ISE/ISE-PIC: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4
• Unified CM/SME: release 15SU5 or later; release 14 must migrate to a fixed release

Immediate actions

• Inventory Cisco ISE/ISE-PIC, UCS Central and Unified CM/SME deployments and identify running releases
• Restrict network access to the web management interfaces of UCS Central, ISE and Unified CM to trusted administrative networks
• Review UCS Central user accounts and credentials since exploitation of CVE-2026-76506 requires valid credentials
• Advise Unified CM administrators not to follow untrusted links to the management interface

Workarounds

• None available per Cisco advisories for all three CVEs; software upgrade required

Longer-term hardening

• Subscribe to Cisco PSIRT advisories and track fixed-release status
• Monitor web management interface logs for anomalous HTTP requests and unexpected certificate issuance on ISE

Affected and fixed versions

• Cisco — UCS Central Software
  Vulnerable versions: 2.0 and earlier; 2.1 prior to 2.1(2c)
  Fixed in: 2.1(2c)
• Cisco — Identity Services Engine (ISE) and ISE-PIC
  Vulnerable versions: 3.1; 3.2; 3.3; 3.4; 3.5
  Fixed in: 3.1 Patch 12; 3.2 Patch 11; 3.3 Patch 12; 3.4 Patch 7; 3.5 Patch 4
• Cisco — Unified Communications Manager (Unified CM) and Unified CM SME
  Vulnerable versions: 14; 15
  Fixed in: 15SU5 and later

Timeline of Cisco ISE auth bypass

• 2026-11-04 Cisco PSIRT states it is not aware of public announcements or malicious use of any of the three vulnerabilities at publication
• 2026-11-04 Cisco publishes cisco-sa-cucm-xss-5mQn2U5z (CVE-2026-76419, CVSS 6.1, Unified CM/SME XSS); fixed in 15SU5, release 14 must migrate
• 2026-11-04 ISE advisory last updated at 19:56 GMT; fixed Patch releases listed for ISE 3.1 through 3.5
• 2026-11-04 Cisco first publishes cisco-sa-ise-cert-mE9BD5GO (CVE-2026-20241, CVSS 5.3, ISE/ISE-PIC unauthenticated authorization bypass) at 16:00 GMT
• 2026-11-04 Cisco publishes cisco-sa-cucs-rce-LzHSFRDQ (CVE-2026-76506, CVSS 7.6, UCS Central authenticated RCE), Final v1.0; reported by Anand Murugan of GBM
• 2026-11-05 locked-ioc-12 publishes Security Alert A26-11-07 summarizing the three Cisco advisories and urging patching

Sources cited for Cisco ISE auth bypass

• GovCERT.HK Alert A26-11-07: Multiple Vulnerabilities in Cisco Products govcert.gov.hk · Advisory · 2026-11-05
• Cisco UCS Central Software Remote Code Execution Vulnerability (CVE-2026-76506) Cisco · Vendor report · 2026-11-04
• Cisco Identity Services Engine Authorization Bypass Vulnerability (CVE-2026-20241) Cisco · Vendor report · 2026-11-04
• Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVE-2026-76419) Cisco · Vendor report · 2026-11-04
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory MITRE · Research
• CWE-285: Improper Authorization MITRE · Research
• CWE-79: Improper Neutralization of Input During Web Page Generation MITRE · Research

More in vulnerability

• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10
• Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)