EUVD-2026-22973
GHSA-4w7q-f6rr-2p4r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable admin HTTP endpoint (AV:N/AC:L), requires at least Read-Only Admin (PR:L, not PR:N), no interaction; injection escapes the app to compromise the underlying OS as root (S:C, C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node ISE deployments, successful exploitation of these vulnerabilities could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
AnalysisAI
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only Admin credentials run arbitrary OS commands and escalate to root by sending a crafted HTTP request. The flaw stems from insufficient validation of user-supplied input (CWE-77); on single-node deployments a successful exploit can also crash the node, blocking network authentication for not-yet-authenticated endpoints. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Technical ContextAI
Cisco ISE is a policy and network access control (NAC) platform providing RADIUS/TACACS+ AAA, 802.1X, posture, guest and BYOD services on a hardened appliance/VM running a Cisco-managed Linux OS. The vulnerability is a classic OS command injection (CWE-77): an administrative web/API handler passes attacker-influenced input into an underlying shell/system call without sufficient sanitization, so crafted values break out into the OS command context. Because ISE exposes only a restricted management shell to admins by design, breaking through to the underlying OS and then to root (per the description, via a follow-on privilege escalation) represents a full trust-boundary escape. The single affected CPE is cpe:2.3:a:cisco:cisco_identity_services_engine_software, i.e. the ISE software itself rather than any bundled third-party component.
RemediationAI
Patch available per vendor advisory: upgrade to the fixed ISE release identified in Cisco advisory cisco-sa-ise-rce-4fverepv (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-4fverepv); the provided data enumerates vulnerable releases across 3.1, 3.2, 3.3 and 3.4 but does not state the exact fixed build, so consult the advisory's Fixed Software section for the specific patch for your train and do not assume a version. As compensating controls until patched, restrict access to the ISE administration interface to a dedicated management network or jump hosts and block it from general user/internet reachability (trade-off: legitimate remote admins must use the management path/VPN); tightly audit and minimize accounts granted the Read-Only Admin role and rotate/strengthen admin credentials with MFA since a valid low-privilege admin account is the exploitation prerequisite (trade-off: operational friction for delegated monitoring users); and for single-node deployments, prioritize patching and consider adding a redundant node so a DoS on one node does not sever network authentication (trade-off: additional licensing/infrastructure).
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unaut
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to i
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, aut
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authentica
Stored and reflected cross-site scripting vulnerabilities in Cisco Identity Services Engine's web-based management inter
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADI
Same weakness CWE-77 – Command Injection
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today