Cisco ISE EUVD-2026-44716

Exploitation requires valid administrative credentials on the Cisco ISE or ISE-PIC system (explicitly stated in the description and confirmed by CVSS PR:H). The attack is delivered over the network via a crafted HTTP request to the administrative interface (AV:N, AC:L), meaning no local or physical access is required. The limiting factor is the mandatory administrative privilege level - this is not exploitable by lower-privileged users or unauthenticated remote parties. No special non-default configuration is required; any ISE or ISE-PIC deployment where an attacker has obtained administrative credentials is vulnerable. Scope is unchanged (S:U), meaning the impact is confined to the ISE system itself rather than enabling lateral movement to adjacent systems through this vulnerability alone.

The Cisco-provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) scores 5.5 (Medium), which accurately reflects the high privilege barrier (PR:H - valid admin credentials required) that significantly constrains exploitability. The network attack vector (AV:N) and low complexity (AC:L) mean that once an attacker has administrative access, exploitation is straightforward. The C:H rating is justified by the ability to read arbitrary OS files, which on an ISE system could include TLS certificates, database credentials, or RADIUS shared secrets - highly sensitive in a NAC context. The I:L rating for file deletion appears conservative: arbitrary file deletion on an OS could in practice cause significant integrity and availability impact beyond what I:L implies. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC has been identified, indicating it is not currently being actively exploited. The primary realistic risk vector is a compromised or malicious administrator account, insider threat, or credential-theft scenario rather than opportunistic internet scanning.

An attacker who has obtained valid ISE administrative credentials - through phishing, credential stuffing against the admin portal, or insider access - sends a crafted HTTP request containing path traversal sequences to the ISE administrative interface. The application fails to sanitize the input, allowing the attacker to traverse outside the intended directory and retrieve sensitive OS-level files such as private keys, database connection strings, or RADIUS shared secrets stored on the appliance. No public proof-of-concept exploit has been identified at time of analysis, but the low attack complexity means exploitation would be straightforward for a skilled attacker once admin credentials are in hand.