EUVD-2026-81122
GHSA-25wc-3w28-q6vw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network API request (PR:N/AV:N/AC:L/UI:N) bypasses auth to fully compromise the management plane and the identity services it governs (S:C, C/I/A:H); consistent with KEV-confirmed real-world exploitation.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.
This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
AnalysisAI
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against affected Cisco ISE and ISE Passive Identity Connector deployments (ISE 3.1 through 3.5 and ISE-PIC 3.4/3.5) that expose the vulnerable API endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a top-tier, must-patch-now vulnerability with every risk signal aligned toward maximum priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 is the authoritative source for fixed software; no exact fixed release version was included in the provided intelligence, so verify the applicable patched build for each affected train (ISE 3.1 through 3.5 and ISE-PIC 3.4.0/3.5.0) there before upgrading, and upgrade every affected node in a distributed deployment rather than only the primary administration node. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, produce a complete inventory of every Cisco ISE and ISE-PIC deployment and identify which run affected builds (ISE 3.1.0 p8 through 3.5 Patch 3, and ISE-PIC 3.4.0 and 3.5.0); immediately block all internet and broad internal reachability to the web-based management and privileged API interfaces using perimeter firewalls, router ACLs, or management-plane ACLs so that only dedicated, tightly scoped administrative networks can connect, and turn on verbose audit and authentication logging while actively hunting for unauthorized API calls, new administrative accounts, or anomalous sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged
Same weakness CWE-648 – Incorrect Use of Privileged APIs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today