CVE-2026-71460

Description

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/custom_virtualenvs, not license_info. Enables social engineering against Red Hat support and estate sizing reconnaissance.

Overview

State: PUBLISHED
Assigner (CNA): redhat
CVSS severity: MEDIUM
CVSS score: 4.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Effective score: 4.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-862
Reserved: 2026-08-06
Published: 2026-09-23 18:25 UTC
Last updated: 2026-09-24 03:40 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71460.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 19:19:02 UTC
NVD last modified: 2026-09-24 04:17:51 UTC
NVD CVSS v3.1: 4.3 / 10 MEDIUM source: secalert@redhat.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 1.4 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85534

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (5)

Vendor	Product	Versions	Platforms
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	`0:4.6.33-1.el8ap` (unaffected)	—
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	`0:4.6.33-1.el9ap` (unaffected)	—
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	`0:4.7.17-1.el9ap` (unaffected)	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—
Red Hat	Red Hat Ansible Automation Platform 2	—	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

RHSA-2026:71113 vendor-advisoryx_refsource_REDHAT
RHSA-2026:71114 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-71460 vdb-entryx_refsource_REDHAT
RHBZ#2512369 issue-trackingx_refsource_REDHAT

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://access.redhat.com/errata/RHSA-2026:71113 secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:71114 secalert@redhat.com
https://access.redhat.com/security/cve/CVE-2026-71460 secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2512369 secalert@redhat.com

Remediations (10)

2512369 - (CVE-2026-71460) CVE-2026-71460 automation ... - Bugzilla

web:bugzilla.redhat.com

Bug 2512369 ( CVE-2026-71460 ) - CVE-2026-71460 automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/

2026-09-24 11:51 UTC
Cisco alerts customers to second actively exploited zero-day in as many ...

web:cyberscoop.com

Cisco disclosed its second actively exploited zero-day vulnerability in as many days, presenting its customers with back-to-back threats to address in unrelated products. The latest zero-day — CVE - 2026 -76460 — has a maximum-severity rating and was exploited before Cisco disclosed and patched the ...

2026-09-24 11:51 UTC
Cisco ISE Zero-Day: Root Access via Auth Bypass - Lab Space

web:labs.cloudsecurityalliance.org

Cisco has released fixes in ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, and it has advised customers still running the unsupported 3.0 branch to migrate to a supported, patched release rather than expecting a backported fix [1] [3]. The timeline of disclosure compressed an already narrow response window.

2026-09-24 11:51 UTC
Cisco Identity Services Engine Authentication Bypass Vulnerability

web:sec.cloudapps.cisco.com

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized ...

2026-09-24 11:51 UTC
CVE-2026-76460: Cisco ISE Zero-Day Exploited - socprime.com

web:socprime.com

CVE - 2026 -76460 is a critical authentication bypass vulnerability in an API endpoint of Cisco Identity Services Engine and ISE-PIC. Insufficient authentication controls allow an unauthenticated remote attacker to send a crafted request, bypass the web-based management interface, and gain unauthorized access to the device. Cisco warns that successful exploitation may ultimately result in root ...

2026-09-24 11:51 UTC
CVE-2026-76460: Cisco ISE Authentication Bypass Exploitation

web:www.bitsight.com

A critical vulnerability, CVE - 2026 -76460, affecting Cisco ISE & ISE-PIC is being actively exploited. Read more for technical details & impact to organizations.

2026-09-24 11:51 UTC
Unauthenticated attackers are bypassing Cisco ISE's management ...

web:www.helpnetsecurity.com

Cisco confirmed attackers are hitting CVE - 2026 -76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE).

2026-09-24 11:51 UTC
CISA Flags Actively Exploited Cisco ISE Flaw With No Workaround

web:www.meritalk.com

The Cybersecurity and Infrastructure Security Agency (CISA) added a critical Cisco identity-management vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog after finding evidence that attackers are using the flaw. The vulnerability, tracked as Common Vulnerabilities and Exposures ( CVE ) identifier CVE - 2026 -76460, affects Cisco Identity Services Engine (ISE). Cisco assigned the ...

2026-09-24 11:51 UTC
Active Exploitation Alert: Cisco Identity Services Engine ...

web:www.rescana.com

Cisco ISE CVE - 2026 -76460 is a critical unauthenticated API authentication bypass added to CISA KEV on September 16, 2026 . Patch to first-fixed releases and run forensic triage.

2026-09-24 11:51 UTC
Cisco hit by max severity zero-day exploit targeting ... - TechRadar

web:www.techradar.com

CISA added to KEV catalog, mandating federal agencies patch or disable ISE by Sept 19, 2026 Cisco has fixed a maximum-severity vulnerability found in its Identity Services Engine (ISE) that is ...

2026-09-24 11:51 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-71460.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71460",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:04:52.078230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:42:13.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-controller",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.33-1.el8ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-controller",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.33-1.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.6::el10",
            "cpe:/a:redhat:ansible_automation_platform:2.6::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-controller",
          "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.7.17-1.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-26/controller-rhel9",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-27/controller-rhel9",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Chris Meyers (Red Hat)."
        }
      ],
      "datePublic": "2026-09-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "/api/v2/config/ is protected only by IsAuthenticated.\n              license_info (account_number, subscription_id, pool_id,\n              sku, support_level, instance counts) returned to any\n              authenticated user. The superuser/auditor gate only covers\n              project_base_dir/project_local_paths/custom_virtualenvs,\n              not license_info. Enables social engineering against\n              Red Hat support and estate sizing reconnaissance."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T03:40:37.238Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:71113",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71113"
        },
        {
          "name": "RHSA-2026:71114",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71114"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-71460"
        },
        {
          "name": "RHBZ#2512369",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512369"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-06T22:56:31.904Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-06T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-862: Missing Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-71460",
    "datePublished": "2026-09-23T18:25:11.192Z",
    "dateReserved": "2026-08-06T19:31:51.452Z",
    "dateUpdated": "2026-09-24T03:40:37.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}