Cisco ISE CVE-2026-76448

Exploitation requires valid administrative credentials on the Cisco ISE or ISE-PIC device (PR:H) - this is the primary limiting factor and rules out unauthenticated attackers. The attacker then sends a crafted request to specific affected APIs that insufficiently validate user-supplied input before building SQL or HQL (Hibernate Query Language) database queries. No user interaction is required (UI:N) and the vector is network-reachable (AV:N), but the trust required (a working admin account) sharply narrows the realistic attacker set to insiders or those who have already compromised admin credentials. Affects ISE/ISE-PIC 3.1 through 3.5 release trains per the EUVD version list.

This is a genuine but privilege-gated integrity risk rather than an urgent internet-facing crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9 Medium) is network-reachable and low-complexity but explicitly requires PR:H - the description confirms 'the attacker must have valid administrative credentials.' That high-privilege gate is the dominant risk limiter: an attacker already holding ISE admin credentials is highly trusted, so the marginal gain is the ability to reach data or query paths beyond their intended API scope via SQL/HQL injection. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - no evidence of active exploitation. One notable internal inconsistency: the vendor vector sets C:N (no confidentiality impact) yet the description explicitly states the attacker 'could view or modify data that they are not authorized to access,' which implies at least some confidentiality impact; this C:N-vs-description mismatch should be verified against the Cisco advisory. Net: a real defensive priority for hardening/patching ISE, but the PR:H requirement and absence of KEV/EPSS/POC signals place it well below unauthenticated or actively-exploited ISE flaws.

An attacker who has obtained valid Cisco ISE/ISE-PIC administrative credentials (via phishing, credential reuse, or a malicious insider) sends a crafted request to a vulnerable API endpoint that concatenates user-supplied input into a SQL or HQL query. The injection lets them execute arbitrary database queries to read or alter records outside their authorized scope. No public exploit code was identified in the provided data, so exploitation would require custom crafting against the affected APIs.