Cisco ISE EUVD-2026-27862

Exploitation requires valid Cisco ISE administrative credentials with read-only Administrator role or equivalent. The attacker must have network access to ISE's API endpoints (typically restricted to administrative management networks). The vulnerability does not require any special configuration beyond ISE having RADIUS Policy API endpoints enabled (standard in typical deployments). The attacker must bypass the web-based management interface and directly call the affected API endpoints using HTTP requests or API tools - this requires knowledge of ISE's API structure but no technical complexity. The limiting factor is the requirement for authenticated access; unauthenticated users cannot exploit this vulnerability. Additionally, the impact is limited to read access (C:L per CVSS); the attacker cannot modify, delete, or disable RADIUS policies or ISE services, only view restricted policy details.

The risk assessment presents a nuanced picture requiring careful consideration. CVSS score of 4.3 appears low at first glance, placing this in the low-severity category. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-accessible attack with low complexity, but critically requires authenticated access (PR:L = low privileges required) and results only in confidentiality impact (C:L) with no integrity or availability impact. However, in SSVC terms, this represents a functional privilege escalation within an administrative context: a read-only admin gains access to data explicitly restricted from their role. For organizations relying on ISE for network access control, unauthorized disclosure of RADIUS policies could expose security-sensitive authentication rules, potentially aiding lateral movement or policy circumvention attacks. The requirement for valid administrative credentials significantly reduces real-world risk compared to unauthenticated exploits, but the attack is automatically exploitable (AC:L) once credentials are obtained. This appears to be a legitimate but contained risk - not a critical vulnerability but meaningful for ISE deployments where administrative credential compromise is plausible (e.g., through phishing or insider threats). No EPSS score or active exploitation data provided, but the straightforward nature of the attack (direct API calls) suggests the exploit is trivial to execute once authenticated.

An attacker with compromised read-only Administrator credentials (obtained through phishing, credential stuffing, or insider access) logs into Cisco ISE administratively. Rather than accessing RADIUS policies through the standard web interface where role-based restrictions are enforced, the attacker crafts direct HTTP/API requests to the RADIUS Policy API endpoints. The API validation fails to check role permissions and returns sensitive policy data (authentication rules, policy conditions) that should be restricted from read-only accounts. The attacker uses this policy information to identify circumvention points for network access control, enabling lateral movement or bypass of authentication requirements.