Cisco ISE CVE-2026-76447

Exploitation requires network reachability to the OCSP (Online Certificate Status Protocol) responder service of an affected Cisco ISE or ISE-PIC deployment; the vulnerable function of the OCSP responder lacks authentication (CWE-306), so no credentials, user interaction, or non-default configuration is stated as required (PR:N/UI:N/AC:L). The limiting factors are: (1) the attacker must be able to reach the ISE/ISE-PIC OCSP responder endpoint over the network (typically internal/management network segmentation reduces exposure), and (2) the impact is confined to forcing a reload of the OCSP responder's certificate and key material - an availability disruption (A:L) with no confidentiality or integrity consequence and no host compromise.

This is a genuine but low-to-moderate priority issue whose real-world risk is capped by its narrow impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) describes a network-reachable, unauthenticated, low-complexity attack with NO confidentiality or integrity impact and only LOW availability impact - the attacker forces the OCSP responder to reload its certificate and key material on demand. This is a resource/availability disruption (repeated forced reloads could degrade or briefly interrupt OCSP certificate-status validation), not code execution, data theft, or credential compromise, so despite being unauthenticated the ceiling is limited. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or automated weaponization; treat exploitation status as 'no public exploit identified at time of analysis.' The signals are internally consistent (unauthenticated network vector matches CWE-306 missing authentication on a critical function), so no metric conflict needs vendor verification. Prioritize patching because the affected platform is a widely deployed security control (Cisco ISE NAC), but the availability-only impact means this ranks below the confidentiality/integrity ISE flaws in the same advisory batch.

An unauthenticated attacker with network reachability to the ISE/ISE-PIC OCSP responder sends a crafted request to the unauthenticated OCSP function, causing the responder to reload its certificate and key material. Repeating this on demand can disrupt or degrade the availability of OCSP certificate-status responses. No public proof-of-concept was identified in the provided intelligence.