EUVD-2026-80885
GHSA-6cv4-w2cr-6qmr
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable management UI (AV:N) with low complexity (AC:L) but mandatory admin credentials (PR:H); command injection escapes app context to root OS execution, so S:C and C/I/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
AnalysisAI
Cisco ISE and ISE-PIC contain an OS command injection flaw (CWE-78) in their web-based diagnostic tools that lets an authenticated remote attacker with valid administrative credentials execute arbitrary commands and gain root on the underlying operating system. Because the attacker must already hold admin rights (PR:H), this is primarily a privilege-escalation and integrity-risk issue rather than an anonymous entry point, though the CVSS 3.1 score is 9.1 Critical (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) due to the scope change and full loss of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid Cisco ISE/ISE-PIC administrative credentials (PR:H) and network access to the web-based management interface; the attacker sends crafted commands to a diagnostic tool that improperly validates user-supplied input, achieving OS command injection as root. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical) is internally consistent with the description: network-reachable web management interface (AV:N), low complexity (AC:L), but requiring valid administrative credentials (PR:H), with a scope change (S:C) reflecting escape from the application context to arbitrary code execution as root on the underlying OS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the available data, so the authoritative fix guidance must be taken from the Cisco security advisory cisco-sa-ise-cmd-inj-e2CuZCYZ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cmd-inj-e2CuZCYZ), which lists the affected and corrected ISE/ISE-PIC releases - apply the vendor's fixed release once confirmed for your train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict administrative access to Cisco ISE and ISE-PIC management interfaces to trusted IP ranges and enforce multi-factor authentication for all administrative users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today