EUVD-2026-81018
GHSA-xfw8-7hm4-33p5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid ISE admin credentials
-
DeliverySend crafted REST API request
-
ExploitInject SQL into vulnerable parameter
-
ExecutionQuery executes against monitoring DB
-
ImpactExfiltrate monitoring data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid Cisco ISE / ISE-PIC administrative credentials (PR:H) and network reachability to the REST API. Exploitation involves sending a crafted API request containing SQL statements in one of the affected parameters, which are insufficiently validated before concatenation into a query against the monitoring database. Impact is limited to reading information from the monitoring database (no write/integrity or availability effect). The principal limiting factor is the high-privilege prerequisite: an attacker must already hold administrative access, confining realistic exploitation to insiders, stolen-credential scenarios, or post-compromise privilege abuse. Affected: ISE and ISE-PIC 3.1.x through 3.5.x. |
| Impact | This is a moderate-severity, real-but-gated issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) tells a consistent story: network-reachable REST API, low attack complexity, but requiring HIGH privileges (valid administrative credentials), and confidentiality-only impact (C:H, I:N, A:N) since a successful exploit only reads the monitoring database. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or imminent exploitation. The dominant risk-limiter is PR:H: an attacker must already hold admin credentials, which sharply narrows the realistic threat to insider abuse, credential theft, or chaining from a prior compromise. The signals do not conflict - CVSS network vector, absent EPSS/KEV/POC, and the description all agree this is a lower-urgency confidentiality flaw. It is a patch-in-normal-cycle item, elevated somewhat by the ubiquity of Cisco ISE in enterprise NAC deployments and by its bundling in a multi-vulnerability advisory that admins should address together. |
| Exploit ScenarioDerived | An attacker who already possesses valid Cisco ISE/ISE-PIC administrative credentials (e.g., a malicious low-trust admin, or an actor using stolen/phished creds) sends a crafted REST API request embedding SQL syntax into a vulnerable parameter that is concatenated into a backend query. The injected statement executes against the monitoring database, letting the attacker read data beyond their intended scope. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
RemediationAI
Apply the fixed software release identified in Cisco's advisory cisco-sa-ise-multi-hrP9jQSQ (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ) - patch status: not specified in the available data, so confirm the exact fixed build for each affected train (3.1.x through 3.5.x for both ISE and ISE-PIC) directly from that advisory rather than assuming a version number, and plan upgrades during a maintenance window because ISE upgrades require service restarts and cluster coordination that briefly interrupt authentication, authorization, and accounting. Because the vulnerability requires valid administrative credentials (PR:H), the highest-value compensating controls are credential-side: enforce least privilege so that accounts are not granted Super Admin or other roles beyond operational need, rotate administrative credentials and API tokens, enforce MFA for ISE admin and REST API access, and audit for shared or stale admin accounts, accepting that tighter role separation may slow some administrative workflows. Network-side, restrict reachability to the ISE REST API and management interface to trusted administrative subnets using firewall rules or interface access control lists, and avoid exposing the management plane to user or guest VLANs; this reduces the attack surface but will break unmanaged integrations and remote admin access that rely on broad reachability, so inventory consumers (pxGrid, monitoring, orchestration) before tightening. Where possible, disable or block unused REST API and external monitoring integrations and audit API request logs for anomalous query-like parameters or unexpected reads against the monitoring database, noting that the monitoring database holds authentication and endpoint telemetry and should be treated as sensitive data requiring restricted access. There is no public exploit identified at time of analysis, so emergency out-of-band patching is not mandatory, but the fix should be scheduled in the normal maintenance cycle given the high-privilege gating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic SQL injection (CWE-89) in the REST API layer of Cisco ISE and ISE-PIC. Specific API request parameters are insufficiently validated and are then concatenated directly into an SQL statement executed against ISE's monitoring database, allowing an attacker to alter query semantics rather than merely query through the intended interface. Cisco ISE is a network access control and policy platform that authenticates and authorizes endpoints (802.1X, MAB, guest, BYOD, TACACS+), and the monitoring database is the operational data store used for logging, session/authentication records, endpoint posture, and reporting; read access to it can expose authentication telemetry, usernames, endpoint inventories, and policy-related metadata useful for reconnaissance and lateral movement. Both CPE entries confirm the same code base is shared by the appliance product line: cpe:2.3:a:cisco:cisco_identity_services_engine_software and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector, covering 3.1.0 through 3.5.x maintenance and patch levels (including 3.1.0 p1-p11/p72, 3.2.0 p1-p7 and 3.2 Patch 8-10, 3.3 Patch 1-12, 3.4 Patch 1-6, and 3.5.0 / 3.5 Patch 1-3, plus ISE-PIC 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0). Because exploitation requires authenticated administrative access (PR:H in the CVSS vector), the vector describes a privilege-abuse/data-exfiltration primitive rather than an unauthenticated perimeter compromise, and the injected query is read-oriented per the assessed CVSS C:H/I:N/A:N impact.
Know when Cisco Identity Services Engine Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-facing REST API (AV:N) with low complexity (AC:L) but requiring valid admin credentials (PR:H); read-only monitoring-DB disclosure gives C:H, I:N, A:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database.
This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL statement. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the monitoring database. To exploit this vulnerability, the attacker must have valid administrative credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Exploit-DB