EUVD-2026-81107
GHSA-877h-9m58-fr39
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Unauthenticated remote low-complexity API auth bypass (PR:N/AC:L/AV:N); S:C because ISE controls policy for other systems; full admin read/modify justifies C:H/I:H and, realistically, A:H.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device.
This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exploit could allow the attacker to read and modify ISE configuration and identity data with administrative privileges.
AnalysisAI
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Cisco ISE / ISE-PIC REST API web service to be exposed and its port reachable by the attacker; the flaw is that this service performs insufficient authorization checks, so no credentials, user interaction, or special client state are needed once the port is reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided data, so the immediate action is to retrieve the current fix and affected-version matrix from the Cisco advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ) and apply the recommended software update as soon as it is available; Cisco advisories of this type also carry workarounds and fixed-release mappings. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco ISE and ISE-PIC node, determine which ones expose the REST API web service, and immediately block that port from all untrusted segments using firewall rules, load balancer policy, or upstream ACLs so only explicitly trusted administrative networks can reach it; confirm with Cisco TAC whether the ISE REST API can be disabled or restricted to internal management interfaces on your deployed version, and enable enhanced logging and alerting on the REST API and administrative audit trail for anomalous or unauthenticated requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today