EUVD-2026-81131
GHSA-9mjp-cphq-5x57
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network REST API (AV:N), low complexity (AC:L), requires valid admin credentials so PR:H, no user interaction; arbitrary file write yielding root command execution justifies C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device.
This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
AnalysisAI
Path traversal in the Cisco Identity Services Engine (ISE) REST API allows an attacker with valid administrative credentials to write files to arbitrary filesystem locations and ultimately execute commands as root on the appliance. The flaw stems from insufficient validation of file paths in upload or copy operations (CWE-23), and exploitation requires network reachability to the ISE REST API plus high-privileged credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2), so it is gated to authenticated insiders or post-compromise attackers rather than unauthenticated outsiders. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid administrative credentials on the Cisco ISE device (PR:H) and network reachability to the ISE REST API (AV:N); no user interaction is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-impact vulnerability whose real-world risk is materially gated by its authentication requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the Cisco fixed software release identified in Cisco Security Advisory cisco-sa-ise-multi-hrP9jQSQ; the specific patched version numbers are not enumerated in the provided intelligence data, so administrators must consult the advisory's patch matrix for the exact fixed release per train (3.1, 3.2, 3.3, 3.4, or 3.5) before upgrading, and should not assume version numbers not confirmed by Cisco. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to the ISE REST API to only trusted management networks and authorized hosts, and review all administrative accounts for unnecessary privileges or signs of compromise. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-23 – Relative Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today