EUVD-2026-81015
GHSA-46xj-2h8f-mw97
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Remote administrative upload path (AV:N, AC:L), but valid admin credentials required (PR:H); XXE yields file read and SSRF, so confidentiality-only C:H with I:N/A:N and no scope change.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device.
This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package through the administrative interface. A successful exploit could allow the attacker to read arbitrary files from the file system and issue requests to internal systems from the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
AnalysisAI
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid Cisco ISE administrative credentials (PR:H) and the ability to upload a crafted offline profiler feed package through the administrative interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded issue, correctly rated Medium (CVSS 4.9). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed software release identified for your ISE and ISE Passive Identity Connector train in Cisco's advisory (cisco-sa-ise-multi-hrP9jQSQ, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-hrP9jQSQ), and use https://nvd.nist.gov/vuln/detail/CVE-2026-76427 to confirm the affected/fixed version mapping; no public exploit exists, so planned maintenance windows are reasonable, though the flaw should not be left indefinitely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Share
External POC / Exploit Code
Leaving vuln.today