EUVD-2026-81134
GHSA-76wm-7845-5qgq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Network API reachable (AV:N/AC:L), but valid administrative credentials required (PR:H); arbitrary DB read gives C:H, SSRF crosses to other systems (S:C), minimal integrity (I:L), no availability impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database.
This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.
AnalysisAI
SQL injection in the management APIs of Cisco Identity Services Engine (ISE) allows an authenticated administrator to read arbitrary content from the backend database and to pivot into server-side request forgery (SSRF) against internal services reachable from the ISE node. The flaw stems from insufficient validation of certain API parameters that are concatenated directly into a backend SQL query, and it affects ISE 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5.x releases enumerated by EUVD. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid Cisco ISE administrative credentials (PR:H) and network reachability to the ISE management/API interface; the attacker sends a crafted request with SQL statements to a specific affected API endpoint whose parameters are concatenated into a backend SQL query. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but privilege-gated issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The authoritative remediation guidance is the Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ; the input data does not confirm an exact fixed software version, so administrators should consult that advisory to identify the specific patched release for their train and upgrade accordingly, validating against the enumerated affected builds (ISE 3.1.0 p1-p11/p72, 3.2.0 p1-p7 and 3.2 Patch 8-10, 3.3.0 and 3.3 Patch 1-12, 3.4.0 and 3.4 Patch 1-6, 3.5.0 and 3.5 Patch 1-3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco ISE deployment and confirm which nodes run 3.1.x, 3.2.x, 3.3.x, 3.4.x or 3.5.x, enumerate all administrative accounts and their privileges, enable and preserve management API and audit logging on each node, and restrict management API reachability to a small set of trusted administrative subnets or jump hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today