Cisco ISE CVE-2026-76431

Requires valid administrative credentials on the Cisco ISE or ISE-PIC web-based management interface (PR:H) - this is the primary limiting factor and rules out unauthenticated exploitation. The attacker then sends a crafted request to the file management function of the web UI containing directory-traversal character sequences in a user-supplied file path, which are improperly validated before the request is processed. Exploitation is network-reachable (AV:N) and low-complexity (AC:L) with no user interaction, but is bounded to environments where the attacker can reach the management interface and already possesses admin-level access; affected versions are ISE and ISE-PIC 3.1 through 3.5.

This is a genuinely lower-priority issue despite the CRITICAL-vendor context, and the CVSS 4.9 (Medium) rating reflects that honestly. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N shows the decisive limiter: PR:H means the attacker must already hold valid administrative credentials on the ISE/ISE-PIC appliance, which the description confirms ('the attacker must have valid administrative credentials'). Impact is integrity-only file/directory deletion - vendor scored C:N and A:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - there is no signal of active or widespread exploitation. All signals are internally consistent (network vector, low complexity, high privilege) with no contradictions to flag. NOTABLE ANALYST DIVERGENCE: the description says the attacker can delete arbitrary files and directories on the underlying OS, which realistically threatens availability (deleting critical system files/directories can crash or brick the appliance); the vendor's A:N therefore appears to under-score the availability dimension. Net: real but constrained - an already-privileged admin abusing traversal, most relevant as a post-compromise or insider/lower-trust-admin destructive primitive rather than an initial-access threat.

An attacker who has obtained valid ISE/ISE-PIC administrative credentials (via phishing, credential reuse, or a lower-trust admin account) sends a crafted request to the web-based management file-management function containing directory-traversal sequences (e.g. ../../) in a supplied file path. Because the path is not sanitized before the request is validated, the appliance deletes the targeted arbitrary files or directories on the underlying operating system, potentially destroying configuration or system files. No public proof-of-concept exploit was identified at time of analysis.