Cisco ISE Unauthenticated API Authentication Bypass (Root RCE)

#!/usr/bin/env bash
# CVE-2026-76460 Cisco ISE Authentication Bypass - Version Check
# Usage: bash check_cve_2026_76460.sh <ISE_HOST>
# Requires: SSH access to ISE admin CLI
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

HOST="${1:-}"
if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <ISE_HOST>"
  echo "  Checks ISE patch level against CVE-2026-76460 fixed versions."
  exit 3
fi

echo "[*] Connecting to $HOST to retrieve ISE version..."
VERSION_OUTPUT=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "admin@${HOST}" 'show version' 2>/dev/null) || {
  echo "[!] SSH connection failed. Verify connectivity and credentials."
  echo "UNKNOWN"
  exit 2
}

# Extract version and patch level
# Typical output line: "Version      : 3.3.0.430"
# Patch line:          "Patch        : 11"
ISE_VERSION=$(echo "$VERSION_OUTPUT" | grep -i '^Version' | awk -F: '{print $2}' | tr -d ' ')
ISE_PATCH=$(echo "$VERSION_OUTPUT" | grep -i '^Patch' | awk -F: '{print $2}' | tr -d ' ')

if [[ -z "$ISE_VERSION" ]]; then
  echo "[!] Could not parse ISE version from output."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected ISE Version: $ISE_VERSION"
echo "[*] Detected ISE Patch Level: ${ISE_PATCH:-none}"

# Extract major.minor
MAJOR_MINOR=$(echo "$ISE_VERSION" | grep -oP '^\d+\.\d+')
PATCH_NUM=${ISE_PATCH:-0}

case "$MAJOR_MINOR" in
  3.0)
    echo "[!] ISE 3.0 is END-OF-LIFE. No fix available. Must migrate."
    echo "VULNERABLE"
    exit 1
    ;;
  3.1)
    FIXED_PATCH=12
    ;;
  3.2)
    FIXED_PATCH=11
    ;;
  3.3)
    FIXED_PATCH=12
    ;;
  3.4)
    FIXED_PATCH=7
    ;;
  3.5)
    FIXED_PATCH=4
    ;;
  *)
    echo "[?] Unrecognized ISE version: $MAJOR_MINOR"
    echo "UNKNOWN"
    exit 2
    ;;
esac

if [[ "$PATCH_NUM" -ge "$FIXED_PATCH" ]]; then
  echo "[+] ISE $MAJOR_MINOR Patch $PATCH_NUM >= fixed Patch $FIXED_PATCH"
  echo "PATCHED"
  exit 0
else
  echo "[-] ISE $MAJOR_MINOR Patch $PATCH_NUM < fixed Patch $FIXED_PATCH"
  echo "VULNERABLE"
  exit 1
fi