Cisco ISE CVE-2026-76444

Exploitation requires network reachability to the Policy Runtime Repository Table (PRRT) internal service on Cisco ISE or ISE-PIC (affected: ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0). No authentication, user interaction, or non-default configuration is stated as required (CWE-306 missing authentication; AV:N/AC:L/PR:N/UI:N). The principal limiting factor is that the vulnerable service is an internal service - if ISE management/internal interfaces are segmented and not exposed to untrusted networks, an attacker cannot reach the PRRT endpoint, sharply reducing real-world exposure. Impact is limited to disclosure of sensitive configuration information (C:L); no data modification or denial of service results.

This is a moderate-severity information-disclosure flaw, not a critical one, and the signals are internally consistent. The vendor CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly captures an unauthenticated, network-reachable weakness (CWE-306, missing authentication on the Policy Runtime Repository Table service) whose only impact is partial confidentiality - no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this is not a demonstrated priority for active exploitation. The main thing that keeps it from being trivially low-risk is the PR:N/AC:L combination on a ubiquitous enterprise NAC appliance: an unauthenticated request leaking configuration data is easy to automate if the affected internal service is exposed. However, the C:L (partial confidentiality, no I/A) caps the real-world damage to reconnaissance-grade config disclosure rather than device takeover. No signals conflict; the low CVSS despite an unauthenticated vector is explained honestly by the narrow C:L-only impact. Treat as a patch-in-normal-cycle item unless the ISE admin/internal interfaces are network-exposed, in which case prioritize higher because disclosed config could seed follow-on attacks.

An unauthenticated attacker who can reach the affected Cisco ISE / ISE-PIC device over the network sends a crafted request to the Policy Runtime Repository Table (PRRT) internal service, which fails to require authentication. The service responds with sensitive configuration information that the attacker can use for reconnaissance and to plan follow-on attacks. No public exploit code has been identified at time of analysis.