EUVD-2026-81154
GHSA-2whp-8f85-4cqh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) tells the real story: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold valid administrative credentials, per the Cisco description. Impact is confidentiality-only (C:H, arbitrary file read); there is no integrity or availability effect (I:N/A:N), so this cannot directly modify configuration or crash the device. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent mass exploitation. The dominant limiting factor is the administrative-privilege requirement: an attacker who already has ISE admin access has substantial legitimate reach, which lowers the marginal value of this bug (its main use is exfiltrating on-disk secrets - private keys, credential stores, config - that the admin UI does not otherwise expose, or as a post-compromise/credential-theft escalation step). Treat as a medium-severity confidentiality issue to patch on a normal Cisco cadence rather than an emergency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
RemediationAI
No vendor-released patch identified at time of analysis - the provided intelligence does not list a fixed release version, so confirm the exact remediated patch level in Cisco's advisory cisco-sa-ise-multi-traversal-WDTgYCdn (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn) and upgrade ISE or ISE-PIC to that build before relying on any other control. Because exploitation requires valid administrative credentials, the highest-value compensating controls are credential and access governance: restrict administrative access to the ISE management interface (HTTPS GUI on the admin persona) to a small set of trusted management subnets or jump hosts via upstream ACLs/firewall rules, and audit and prune ISE admin accounts and RBAC roles so that certificate-import-capable privileges are held only by staff who need them. The trade-off is that locking the GUI down to a jump host adds administrative friction and can disrupt remote or third-party support workflows, and external ACLs must be kept in sync across every node of a distributed deployment or admins will lose access to individual PSNs. Additional lower-cost measures include enforcing MFA and strong unique passwords for ISE admins, enabling and reviewing audit logs for certificate import and file-management operations on the admin interface, and treating the appliance as a credential-bearing system (rotating stored RADIUS/TACACS secrets, pxGrid certificates, and private keys if an admin account is suspected of compromise), since the primitive yields file reads rather than code execution and therefore cannot be neutralized by a simple feature toggle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in the certificate import workflow that is part of Cisco Identity Services Engine's web-based administrative GUI; the affected code fails to sanitize user-supplied input before using it in a filesystem path, so crafted requests can step outside the intended certificate directory and return the contents of arbitrary files. Cisco ISE is the policy and network access control backbone for many enterprises - it stores posture data, pxGrid integration material, RADIUS/TACACS secrets, internal certificates and private keys, and configuration backups - so a file-read primitive against it is more consequential than a generic arbitrary-file-read, even though the confidentiality-only impact keeps the CVSS score modest. Both CPE entries are wildcarded (cpe:2.3:a:cisco:cisco_identity_services_engine_software:* and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector:*), indicating the vulnerability spans the whole product lines rather than a single build, and Cisco classifies the two products together under its advisory cisco-sa-ise-multi-traversal-WDTgYCdn. The high privilege requirement (PR:H) and network vector (AV:N) mean the vulnerable endpoint is the admin-facing HTTPS interface rather than the RADIUS/PAC service path.
Know when Cisco Identity Services Engine Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input by the affected feature. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to read arbitrary files from the affected device, which could contain sensitive information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Exploit-DB