Cisco ISE CVE-2026-76424

Requires valid administrative credentials on the Cisco ISE device (PR:H) and network reachability to the ISE REST API (AV:N); no user interaction is needed. The specific trigger is a file upload/copy operation through the REST API where the attacker supplies a crafted (path-traversal) file path that insufficient validation fails to reject, causing the file to be written to an arbitrary location and subsequently executed as root. Limiting factors: the mandatory administrative-credential prerequisite confines this to authenticated insiders or post-compromise attackers, and exposure depends on the ISE management/REST API being reachable from the attacker's position. Affected releases span ISE 3.1 through 3.5 (see advisory patch matrix); apply the fixed patch level for the deployed train.

This is a genuine high-impact vulnerability whose real-world risk is materially gated by its authentication requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) shows a network-reachable, low-complexity flaw with full C/I/A impact, but PR:H is the decisive limiter: exploitation requires valid administrative credentials, which the description explicitly confirms ('the attacker must have valid administrative credentials'). This makes it a near-trusted-attacker or post-compromise/privilege-abuse scenario rather than a mass-exploitable perimeter bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - status is 'no public exploit identified at time of analysis.' The consequence, however, is severe: arbitrary file write to attacker-chosen paths leading to arbitrary command execution as root, effectively full device takeover. Note a labeling conflict: the input Tags include 'Information Disclosure,' which understates the true impact (root RCE via arbitrary file write) - this should not be read as a mere disclosure issue. Net: prioritize patching because ISE is a security-critical identity/NAC platform where root compromise is catastrophic, but the PR:H gate means it is not a drive-by internet threat and ranks below the unauthenticated (PR:N) members of Cisco's recent ISE advisories.

An attacker who has obtained valid ISE administrative credentials (via phishing, credential reuse, a rogue/over-privileged admin, or an earlier foothold) sends a crafted REST API request that uploads or copies a file specifying a traversal path outside the intended directory. Because file-operation validation is insufficient, the file lands in an attacker-controlled location and is leveraged to execute arbitrary commands as root, yielding complete control of the ISE appliance. No public exploit code was identified at time of analysis; exploitation requires prior administrative access, not user interaction.