EUVD-2026-22962
GHSA-6m6h-8f8v-r7j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAcquire administrative credentials
-
DeliverySend crafted HTTP request to management interface
-
ExploitInject OS command via unsanitized input
-
ExecutionExecute command as low-privilege user
-
PersistEscalate privileges to root
-
ImpactCompromise underlying operating system or cause denial of service in single-node deployments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid administrative credentials to the Cisco ISE or ISE-PIC management interface. No additional non-default configuration is needed; the vulnerable input validation occurs during normal administrative operations within the web interface. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a critical-severity, remote exploit with changed scope, but the vendor description explicitly requires valid administrative credentials - a significant contradiction. If administrative credentials are indeed necessary, the realistic attack complexity is higher than the CVSS suggests. EPSS predicts a 0.23% probability of exploitation in the next 30 days (46th percentile), and CISA's SSVC assessment notes no current exploitation and non-automatable exploitation. No active exploitation has been confirmed via KEV. While the technical impact is total (system compromise and potential denial of service), the requirement for administrative access and the absence of active exploitation reduces the immediate risk. The high CVSS score overstates the practical urgency. |
| Exploit ScenarioDerived | An attacker who has obtained administrative credentials sends a crafted HTTP request to the ISE management interface. The request injects operating system commands that execute with limited user rights, and an included privilege escalation mechanism then elevates the attacker to root. No public exploit code has been identified, but the attack vector is straightforward once credentials are acquired. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
RemediationAI
Cisco has released patched software versions; administrators should upgrade to the fixed release indicated in the vendor advisory cisco-sa-ise-rce-traversal-8bYndVrZ. As an immediate compensating control, restrict administrative access to the ISE management interface to a limited set of trusted IP addresses and monitor for anomalous administrative activity. In environments where patching is delayed, consider disabling the vulnerable management interface if not needed, though this will impact normal administrative operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper neutralization of special elements in a command (CWE-77) in the web-based management interface of Cisco ISE and ISE-PIC. Insufficient validation of user-supplied input within an HTTP request allows an attacker to inject operating system commands. Affected products are identified by CPE: cpe:2.3:a:cisco:cisco_identity_services_engine_software and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector.
Know when Cisco Identity Services Engine Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Requires administrative credentials (PR:H) per vendor, network vector, no user interaction, scope changed due to OS compromise.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
Zero Day Initiative Advisories
Executive ViewAI
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) contain a critical command injection vulnerability that could allow an authenticated administrative attacker to execute arbitrary OS commands and escalate privileges to root. In single-node deployments, this can also cause a denial of service, disrupting network access for unauthenticated endpoints. Although no active exploitation has been observed and the immediate threat is currently low, the severity of the impact on network security and availability requires proactive mitigation.
Restrict administrative access to trusted users only, enforce least-privilege via role-based access controls, enable multi-factor authentication for all admin accounts, segment ISE/PIC systems on the network to limit blast radius, and monitor logs for unauthorized command execution attempts. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged
Exploit-DB