EUVD-2026-81121
GHSA-qwcp-547c-v9v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Unauthenticated network-reachable RADIUS request (AV:N/AC:L/PR:N/UI:N) causing availability-only DoS (A:H, C/I:N); S:C because the NAC node outage denies network access to dependent endpoints.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a crafted RADIUS request directly to an affected device. A successful exploit could allow the attacker to cause the ISE node to become unavailable. For single node deployments in that condition, endpoints that have not already authenticated would be unable to access the network until the node comes back up on its own.
AnalysisAI
Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the RADIUS feature/service of an affected Cisco ISE node (versions 3.2.0 through 3.5, including numerous 3.2/3.3/3.4 patch levels per EUVD). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded-impact issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the available input data (the only reference is the Cisco advisory cisco-sa-ise-RADIUS-dos-wR3hYPMw at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-RADIUS-dos-wR3hYPMw, which carries the official fixed-software table for the 3.2, 3.3, 3.4 and 3.5 trains) - consult that advisory and upgrade to the listed fixed release for your train rather than assuming a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco ISE deployments and confirm which are running affected versions 3.2.0 through 3.5, then restrict RADIUS traffic to trusted sources using network ACLs or firewall rules to reduce exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today