Cisco ISE EUVD-2026-81137

Exploitation requires ALL of: (1) valid administrative credentials on Cisco ISE (PR:H) - this is not an unauthenticated flaw; (2) the target ISE node must be configured with more than one network interface; and (3) one of those interfaces must be configured as an active IPsec tunnel - a specific non-default deployment. Given these, the attacker sends crafted input to the IPsec Open API endpoint over the network (AV:N/AC:L) to achieve OS command injection, which Cisco notes escalates easily to root. The IPsec-tunnel and multi-interface requirements plus admin authentication are the key limiting factors that keep this from being broadly exploitable against default installs.

The vendor CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), but Cisco explicitly overrides the numeric severity by assigning a Security Impact Rating of High, stating it is 'easy to get to root from the achieved privilege level' - a meaningful conflict where the raw score understates real impact and the vendor's qualitative rating should take precedence. The PR:H requirement (valid administrative credentials) plus two non-default deployment prerequisites (a node with more than one network interface, one configured as an active IPsec tunnel) are the primary risk limiters, keeping this out of mass-exploitation territory. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; combined with the admin-authentication gate this is a post-authentication root-escalation / lateral-integrity concern rather than an internet-facing unauthenticated emergency. Net priority: elevated for ISE operators (root on a NAC choke point is severe and Cisco flags easy root) but bounded by the admin credential and IPsec-tunnel configuration prerequisites - patch promptly but it is not a drop-everything unauthenticated RCE.

An attacker who already holds valid ISE administrative credentials (e.g., a lower-tier or compromised admin) targets an ISE node deployed with a second interface running an active IPsec tunnel, and sends crafted input to the IPsec Open API endpoint. The input is insufficiently validated and is passed to the underlying OS, letting the attacker execute arbitrary commands and, per Cisco, readily escalate to root. No public exploit code is identified at time of analysis, and the network attack vector (AC:L) means the crafted API call is straightforward once the prerequisites are met.