Cisco ISE EUVD-2026-81134

Exploitation requires valid Cisco ISE administrative credentials (PR:H) and network reachability to the ISE management/API interface; the attacker sends a crafted request with SQL statements to a specific affected API endpoint whose parameters are concatenated into a backend SQL query. No end-user interaction is needed (UI:N). The primary limiting factor is the high-privilege authentication barrier - this is an authenticated-admin capability, not an unauthenticated perimeter flaw - which confines realistic abuse to compromised admin accounts or malicious insiders. Affected releases span ISE 3.1.x, 3.2.x, 3.3.x, 3.4.x, and 3.5.x per EUVD; deployments already restricting and monitoring admin API access reduce exposure.

This is a genuine but privilege-gated issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N = 7.6 High) is internally consistent with the description: network-reachable API, low complexity, but requiring high privileges (valid administrative credentials), yielding high confidentiality impact (arbitrary DB read) plus a scope change (S:C) reflecting the SSRF pivot to other systems. The dominant limiting signal is PR:H - the attacker must already be an authenticated ISE administrator, which sharply narrows the realistic threat population to insiders or attackers who have already compromised admin credentials. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or imminent mass weaponization; this reads as an authenticated-admin post-access capability rather than a wormable perimeter threat. Signals are not conflicting: EPSS/KEV/POC are simply absent (absence is not evidence of low risk, but nothing here elevates urgency). Net: a real vulnerability worth patching on a normal enterprise cadence, not an emergency, primarily because of the PR:H barrier.

An attacker who has obtained valid Cisco ISE administrative credentials (e.g., via phishing, credential reuse, or a malicious insider) sends a crafted request containing SQL statements to a vulnerable ISE API endpoint. The unsanitized parameters are concatenated directly into a backend SQL query, letting the attacker read arbitrary database content and coerce the server into making attacker-directed requests (SSRF) to internal systems. No public exploit code is identified at time of analysis.