EUVD-2026-81132
GHSA-9jpc-f2m6-gmpp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Remote API reachable (AV:N/AC:L); requires valid admin credentials (PR:H); injection reaches backend DB beyond API scope (S:C) yielding DB read/write and single-node DoS (C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks.
This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the underlying database for the affected device. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored. To exploit this vulnerability, the attacker must have valid administrative credentials, have the SXP service enabled, and have at least one SXP connection configured.
AnalysisAI
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete preconditions stated in the advisory: (1) valid administrative credentials for the ISE node (PR:H), (2) the SXP (Security Group Tag Exchange Protocol) service must be enabled, and (3) at least one SXP connection must already be configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an authenticated, network-reachable SQL injection in the SXP REST API of Cisco ISE, rated 9.1 by Cisco (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Cisco ISE to a release identified as fixed in Cisco advisory cisco-sa-ise-mult-vul-ymSsTLCc (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-vul-ymSsTLCc) - patch availability is documented per vendor advisory, and the exact fixed build number is not enumerated in the input data, so confirm the target version against that advisory rather than assuming a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether the optional SXP service is enabled and whether any SXP connections are configured - if SXP is not operationally required, disable the service and remove all SXP connections; inventory every ISE administrator account holding privileged access, confirm each is still needed, enforce multi-factor authentication, and rotate credentials on any account that is shared, stale, or externally reachable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged
Share
External POC / Exploit Code
Leaving vuln.today