Cisco ISE EUVD-2026-81107

Exploitation requires the Cisco ISE / ISE-PIC REST API web service to be exposed and its port reachable by the attacker; the flaw is that this service performs insufficient authorization checks, so no credentials, user interaction, or special client state are needed once the port is reachable. The primary limiting factor is network reachability of the REST API port - organizations that restrict management/API interfaces to isolated admin networks materially reduce exposure, whereas any ISE node with the REST API reachable from an untrusted segment is directly exploitable against default authorization behavior.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) describes the worst realistic profile for an enterprise security appliance: fully unauthenticated, network-reachable, low-complexity, and with a scope change because compromising ISE grants control over identity and network-access policy for downstream systems. CWE-290 (authentication bypass) is consistent with the description of 'insufficient authorization checks' on an exposed REST API, and the 'Authentication Bypass' tag is accurate here (unlike many authZ-mislabeled cases). Signal alignment is strong: attack vector, complexity, and privilege metrics all point to trivial remote exploitation, and the impact is administrative read/modify of configuration and identity data. Key caveats: no EPSS score, no CISA KEV entry, no SSVC decision data, and no public POC are present in the provided input, so exploitation is currently only a capability, not a confirmed campaign. Note that this maps to Cisco's cisco-sa-ise-multi advisory family, and Cisco ISE has a recent history of actively-exploited unauthenticated flaws (e.g., the 2025 ISE RCEs) - that history raises the practical urgency but is context, not evidence of exploitation for this specific CVE. The A:L (rather than A:H) is a conservative vendor choice given that full admin access typically implies full availability control.

An attacker locates an internet- or network-reachable Cisco ISE / ISE-PIC node with its REST API port exposed and sends a single crafted HTTP request that bypasses the insufficient authorization checks. With no credentials required, the attacker obtains administrative access and reads or modifies ISE configuration and identity/policy data, pivoting to control network-access decisions for downstream systems. No public exploit code is identified in the provided data, but the low attack complexity makes weaponization straightforward.