EUVD-2026-81016
GHSA-2428-c4mc-4v7f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
PR:H because valid admin credentials are required; I:H for arbitrary file deletion; I diverge from vendor by adding A:H since deleting arbitrary OS files/directories can render the appliance unavailable.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper validation of directory traversal character sequences in a user-supplied file path before the request is validated. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to delete arbitrary files and directories on the underlying operating system of the affected device.
AnalysisAI
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid administrative credentials on the Cisco ISE or ISE-PIC web-based management interface (PR:H) - this is the primary limiting factor and rules out unauthenticated exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely lower-priority issue despite the CRITICAL-vendor context, and the CVSS 4.9 (Medium) rating reflects that honestly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available intelligence for this CVE, so treat the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-traversal-WDTgYCdn) as the authoritative source and apply the fixed maintenance release Cisco designates for your train (3.1, 3.2, 3.3, 3.4, or 3.5) as soon as it is published; do not upgrade blindly to an arbitrary patch level without checking that advisory, and plan a maintenance window because ISE upgrades are disruptive and require backup/rollback readiness. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today