Cisco ISE EUVD-2026-81122

No special conditions - remote unauthenticated exploitation against affected Cisco ISE and ISE Passive Identity Connector deployments (ISE 3.1 through 3.5 and ISE-PIC 3.4/3.5) that expose the vulnerable API endpoint. The vulnerability stems from insufficient authentication control on a specific API endpoint reachable via the web-based management interface, so the principal limiting factor is network reachability of that management/API interface: appliances whose admin/API plane is segmented away from untrusted networks are harder to reach, though the flaw itself needs no credentials, user interaction, or non-default configuration. Given confirmed active exploitation, any internet- or broadly-reachable ISE management interface should be treated as compromised until patched.

This is a top-tier, must-patch-now vulnerability with every risk signal aligned toward maximum priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) scores a perfect 10.0: network-reachable, low complexity, no privileges, no user interaction, with a scope change and full confidentiality/integrity/availability impact. Critically - and unlike most vendor-asserted grouped Cisco advisories - this is CONFIRMED in the CISA KEV catalog as actively exploited in the wild AND has publicly available exploit code, so the theoretical severity is matched by real-world weaponization. There is no conflict among the signals here: KEV=YES, POC=YES, and a maximal CVSS all point the same direction. The combination of unauthenticated pre-auth access, active exploitation, and public exploit against an internet-facing identity/NAC control plane makes this a genuine emergency rather than a high-CVSS-but-low-real-risk paper finding. EPSS was not provided, but that is immaterial given confirmed KEV status. The only note of caution: the description is terse ('insufficient authentication control on an API endpoint') and does not specify the exact endpoint or which patch trains contain the fix - cross-reference the Cisco advisory cisco-sa-ISE-ABP-VNSW7Tn5 for fixed-version mapping before remediating.

A remote, unauthenticated attacker sends a single crafted HTTP request to a vulnerable Cisco ISE API endpoint that fails to enforce authentication, bypassing the web-based management interface and gaining unauthorized administrative access to the device. Because public exploit code exists and CISA confirms active in-the-wild exploitation, this requires no special skill and can be automated at scale against internet-exposed or reachable ISE deployments. Successful exploitation yields control of the identity/NAC control plane, cascading to the network access policies ISE governs.