EUVD-2026-81144
GHSA-57hw-773v-68wr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network path traversal (AV:N/AC:L/PR:N/UI:N) yielding read of protected files maps to C:L; no integrity or availability impact, so I:N/A:N (differs from vendor's C:N/I:L).
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device.
This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.
AnalysisAI
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Cisco ISE / ISE-PIC client provisioning download service and no authentication (PR:N, UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed software version is specified in the available input data, so treat the Cisco Security Advisory cisco-sa-ise-multi-traversal-WDTgYCdn (also referenced via https://nvd.nist.gov/vuln/detail/CVE-2026-76433) as the authoritative source for the patched ISE and ISE-PIC builds and upgrade the affected 3.1 through 3.5 installations to the fixed release Cisco names for each train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today