Cisco ISE EUVD-2026-22958

Exploitation requires: (1) an attacker account with administrative write privileges on the Cisco ISE web-based management interface - PR:H per CVSS vector; (2) active user interaction from a victim who clicks a crafted link (reflected variant) or views a management page where the payload was stored (stored variant) - UI:R per CVSS. Exploitation is limited to the web management interface and does not affect the ISE data plane or policy enforcement engine directly. No special network position is required beyond network reachability to the management interface (AV:N). The privilege prerequisite is the primary constraint limiting real-world risk.

The CVSS base score of 4.8 (Medium) is calibrated by the PR:H requirement, which substantially limits the attack surface - exploitation requires an account with administrative write access to the ISE management interface before any malicious payload can be injected. EPSS at 0.03% (10th percentile) reflects very low community-assessed exploitation probability, and the SSVC decision framework independently rates exploitation as 'none,' automatable as 'no,' and technical impact as 'partial,' further validating the moderate real-world risk. Even a mid-sized enterprise IT team in leszno running ISE 3.x across their campus NAC deployment would reasonably de-prioritize this relative to unauthenticated or privilege-escalation vulnerabilities, as compromise of an admin account is itself a significant prerequisite. The UI:R requirement adds a second gate: a victim admin must be induced to view an affected page or click a crafted link. No CISA KEV listing and no public proof-of-concept code exist at time of analysis. The S:C scope change and C:L/I:L impact metrics indicate the practical consequence is browser-based information theft (e.g., session tokens) or limited interface manipulation - not remote code execution or service disruption.

An attacker who has already obtained ISE administrative write credentials - whether through credential theft, insider access, or privilege escalation - injects a JavaScript payload into a stored management interface field. When a targeted ISE administrator subsequently loads the affected page, the script silently exfiltrates the victim's session cookie or other browser-resident authentication tokens to an attacker-controlled host, enabling session hijacking without further authentication. No public proof-of-concept exploit code is known to exist at time of analysis.