EUVD-2026-81159
GHSA-757m-6669-crwx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Remote API reachable (AV:N/AC:L) but requires high-privilege admin auth (PR:H); XXE yields file-read confidentiality only (C:H, I:N/A:N), no scope change.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device.
This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read specific files on the affected system that the underlying process has permission to access.
AnalysisAI
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high-privilege (administrative, PR:H) authenticated access to the Cisco ISE or ISE-PIC management API; it is not reachable by an unauthenticated or low-privilege user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity information-disclosure flaw, correctly scored by Cisco at CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The available data does not identify an exact vendor-fixed release version for CVE-2026-76446, so the authoritative fix list should be taken from the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4 and applied by upgrading each affected ISE and ISE-PIC node (including distributed deployment personas) to the first patched build Cisco names for its 3.1, 3.2, 3.3, 3.4, or 3.5 train; the fact that patches as recent as ISE 3.5 Patch 3, 3.3 Patch 11, and 3.2 Patch 10 are still listed as affected strongly suggests remediation lands in a later patch level than any enumerated here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Share
External POC / Exploit Code
Leaving vuln.today