Cisco ISE CVE-2026-76451

Exploitation requires valid administrative credentials on the target Cisco ISE or ISE-PIC device (PR:H) - this is the primary limiting factor, restricting the attack surface to authenticated high-privilege admins or attackers who have compromised such an account. The attacker sends a crafted request to specific affected ISE APIs that build database queries from insufficiently validated user-supplied input, triggering SQL or HQL (Hibernate) injection. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) against the management interface, but no non-default configuration is called out - any supported ISE/ISE-PIC version in the affected list (3.1 through 3.5 trains) is exposed once admin access is held. The high-privilege prerequisite, not deployment configuration, is what bounds realistic risk.

The vendor scores this CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N (4.9, Medium). The dominant limiting signal is PR:H - the description explicitly states the attacker 'must have valid administrative credentials,' so this is a post-authentication integrity flaw exploitable only by an already-trusted high-privilege admin, not an anonymous internet attacker. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a genuine internal conflict: the vector sets C:N (no confidentiality impact), yet the description says a successful exploit could 'view or modify data that they are not authorized to access' - 'view' implies a confidentiality impact that the vendor's C:N omits, which likely understates the true score; a SQL/HQL injection primitive typically yields read as well as write. Bottom line: this is a real but lower-priority finding - the high-privilege authentication barrier sharply constrains real-world risk, making it more relevant as a defense-in-depth / insider-threat and privilege-escalation-chaining concern than a mass-exploitation threat.

An attacker who already holds valid Cisco ISE administrative credentials (or has compromised such an account) sends a crafted request to an affected API endpoint, embedding malicious input that ISE concatenates unsanitized into a backend SQL or Hibernate (HQL) query. The injected query lets them read or alter database records beyond their authorization scope on the ISE/ISE-PIC appliance. No public proof-of-concept exploit code is identified in the available data.