EUVD-2026-81160
GHSA-hp7w-rvwf-v5vm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable web UI (AV:N/AC:L) but requires high-privilege admin with user-management rights (PR:H); leaks passwords (C:H) with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to.
This vulnerability exists because certain files lack proper authorization enforcement. An attacker with administrative privileges and management rights over network users could exploit this vulnerability by exporting the users. A successful exploit could allow the attacker to view passwords that are normally not visible to administrators.
AnalysisAI
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Cisco ISE administrator account that has been granted management rights over network users; the attacker then uses the user-export feature, whose underlying files lack proper authorization enforcement, to read data for users outside their assigned security group. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but tightly-gated confidentiality issue, not a broad emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed software release identified in Cisco Security Advisory cisco-sa-ise-multi-vuln-kWLeNnRD (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-kWLeNnRD), which is the authoritative source for the patched patch levels corresponding to each affected ISE 3.1-3.5 train - Cisco patch numbering differs per train, so verify the exact target build for your branch before upgrading rather than assuming a generic latest version; the provided data does not enumerate specific fix build numbers, so treat the advisory as the definitive version reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today