EUVD-2026-81164
GHSA-v6ff-rccc-xfhv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network web UI, low complexity, requires an authenticated lower-privilege admin account (PR:L) with no user interaction; impact is limited integrity change only (I:L), no C or A.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device.
This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials.
AnalysisAI
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid, authenticated access to the ISE/ISE-PIC web-based management interface with an administrator-tier account that lacks full Administrator permissions (PR:L); exploitation is a single crafted HTTP request to the affected configuration page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity, high-friction issue that does not warrant priority patching in isolation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because the provided intelligence does not identify a specific fixed build, treat the Cisco Security Advisory cisco-sa-ise-auth-bypass-1-MxcTNgwx (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-1-MxcTNgwx) as the source of truth for the exact patched ISE and ISE-PIC versions per train and upgrade to that release; patch status is therefore 'No vendor-released patch identified at time of analysis' based on the supplied data only. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today