EUVD-2026-81111
GHSA-x989-w3qv-v3x5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable crafted HTTP request (AV:N/AC:L) but requires high-priv admin creds (PR:H); command injection escapes app to root OS access (S:C, C/I/A:H).
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain system-level access to the underlying operating system and then elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a DoS condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.
AnalysisAI
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator to execute arbitrary OS commands and escalate to root by sending a crafted HTTP request. The provided data identifies affected Cisco ISE software via CPE and notes that in single-node deployments exploitation can also render the node unavailable, causing a DoS condition that blocks unauthenticated endpoints from reaching the network until the node is restored. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid HIGH-PRIVILEGED administrative credentials on the target Cisco ISE device (PR:H) - this is the dominant limiting factor and excludes unauthenticated and low-privilege attackers entirely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 9.1 (Critical) is driven by network reachability (AV:N), low complexity (AC:L), scope change (S:C, command execution crosses from the ISE application into the underlying OS), and full C:H/I:H/A:H impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed software release specified in Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rce-se7bYU57; the supplied data does not include an exact fix version, so verify the advisory for the patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict administrative access to Cisco ISE management interfaces to trusted networks and accounts, enable detailed logging and monitoring for suspicious HTTP requests, and review all high-privileged accounts for unnecessary privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today