Cisco ISE CVE-2026-76439

Exploitation requires network reachability to the Cisco ISE guest portal web application, which exposes an internal posture-status reporting interface that performs insufficient authentication (CWE-306). Per the CVSS vector (PR:N/UI:N/AC:L), no credentials, no user interaction, and no elevated privileges are needed - the attacker only needs to send a crafted request to an affected system. The principal limiting factor is deployment context: the guest portal and endpoint posture assessment must be enabled and reachable by the attacker, and impact is confined to manipulating posture status (Integrity-Low) - there is no confidentiality or availability effect. Affected products are Cisco Identity Services Engine Software and Cisco ISE Passive Identity Connector across the 3.1, 3.2, 3.3, 3.4, and 3.5 trains.

This is a genuine but deliberately narrow-impact issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 MEDIUM) is internally consistent with the description: an unauthenticated remote attacker reaches an internal posture-reporting interface exposed via the guest portal and injects forged posture status events. Critically, the impact is scoped to Integrity-Low only - C:N and A:N mean no data disclosure and no denial of service; the attacker can manipulate endpoint posture state but cannot read data or crash the system. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation - treat this as 'no public exploit identified at time of analysis.' The high CVSS attack-vector metrics (network, low complexity, no privileges/UI) make it trivially reachable, but the low technical impact caps real-world severity. The practical risk is that a manipulated posture status could let a non-compliant or malicious endpoint be judged 'compliant' and receive broader network access than policy intends - a meaningful authorization-integrity concern in NAC deployments, but not a direct compromise of ISE itself. Net: a legitimate patch-worthy MEDIUM, not an emergency; prioritize based on whether guest-portal posture enforcement is actually relied upon for access decisions.

An unauthenticated attacker who can reach the Cisco ISE guest portal sends a crafted HTTP request directly to the internal posture-status reporting interface, which lacks proper authentication. By submitting forged posture status events into the endpoint posture pipeline, the attacker marks a non-compliant or unauthorized endpoint as 'posture compliant,' potentially causing ISE to grant network access that policy would otherwise deny. No public exploit code was identified in the provided data.