CVE-2026-76447
A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a function of the OCSP responder. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause the OCSP responder to reload certificate and key material on demand.
- Score
- CVSS 3.1 5.3 Medium
- Status
- Analyzed - psirt@cisco.com
- Published
- 2026-09-16
- Last modified
- 2026-09-17
- Weaknesses
- CWE-306
Affected products
- Cisco Identity Services Engine Software (Cisco)
- Cisco Ise Passive Identity Connector (Cisco)
- Identity Services Engine (Cisco)
- Identity Services Engine Passive Identity Connector (Cisco)
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4
