EUVD-2026-81144
GHSA-57hw-773v-68wr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach provisioning download service over network
-
DeliverySend crafted request with traversal sequences
-
ExploitBypass path validation
-
ExecutionRead protected files outside webroot
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Cisco ISE / ISE-PIC client provisioning download service and no authentication (PR:N, UI:N). The affected feature - client provisioning download - must be reachable; in typical NAC deployments this service is exposed to the endpoints/networks being onboarded, which limits exposure to those network segments rather than the full internet unless the ISE portal is externally published. Impact is limited to reading protected files (information disclosure only) - no write, code execution, or availability impact. Applies to Cisco ISE and ISE-PIC versions 3.1 through 3.5 (pre-fixed patch levels). |
| Impact | This is a genuine but modest-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction - the most attacker-favorable access profile. However, the impact is deliberately scoped low: a single low impact metric with the others at None. Note a data conflict: Cisco encoded the impact as I:L (integrity) with C:N, yet the description describes reading/exposing protected files, which is a confidentiality outcome (C:L/I:N would be the natural mapping); the numeric score is unchanged either way, but the vector's C/I placement appears mislabeled - verify with the vendor advisory. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The realistic priority is MEDIUM: the unauthenticated network vector and the ubiquity of Cisco ISE in enterprise NAC deployments raise attention, but the bounded read-only impact (protected file disclosure, no code execution, no write, no service impact) keeps this well below the critical tier. Prioritize patching where ISE is internet- or partner-network-exposed, but this is an information-disclosure hardening fix, not an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the ISE client provisioning download service over the network sends a crafted request containing directory-traversal sequences (e.g., ../) in the provisioning resource path. Because the service insufficiently validates the supplied path, it returns the contents of protected files outside the intended provisioning directory, potentially exposing sensitive configuration or system data. No POC has been published at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
RemediationAI
No exact fixed software version is specified in the available input data, so treat the Cisco Security Advisory cisco-sa-ise-multi-traversal-WDTgYCdn (also referenced via https://nvd.nist.gov/vuln/detail/CVE-2026-76433) as the authoritative source for the patched ISE and ISE-PIC builds and upgrade the affected 3.1 through 3.5 installations to the fixed release Cisco names for each train. Because this is patch-status-dependent and no patch identifier is confirmed in the supplied data, remediation should begin with verifying the current patch level against that advisory. Until upgrading is possible, the most effective compensating control is network scoping: the client provisioning download service only needs to be reached by the endpoints and network segments actually being onboarded, so restrict access to the ISE guest/BYOD onboarding interface with firewall rules, ACLs or segmentation and remove any internet-facing publication of that portal - the trade-off is that endpoints outside the permitted segments can no longer self-provision and must enroll through an allowed path. If client provisioning is not in use at all, disabling the provisioning/BYOD portal removes the attack surface entirely, at the cost of losing supplicant-wizard and profile distribution for new devices. Additionally, inspect web/proxy and ISE logs for requests to the provisioning download endpoint containing encoded or literal '../' sequences, since detection of such requests is a reliable indicator of attempted exploitation, and confirm that files exposed by any suspected read (certificates, configuration exports, stored credentials) are rotated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the client provisioning download feature of Cisco ISE and ISE-PIC takes a user-supplied path when serving provisioning resources and fails to adequately validate directory traversal character sequences before resolving the file. Client provisioning is the enrollment/onboarding component that hands BYOD and guest endpoints their supplicant wizards, profiles and native-supplicant packages; by design it must be reachable by endpoints that have not yet authenticated, which is why the assessed vector shows PR:N and UI:N. Because the traversal sequences are not neutralized, a request that walks out of the intended provisioning resource directory can cause the service to return files outside that directory, exposing protected content readable by the service process (configuration data, certificates, or stored credentials) to an unauthenticated requester. CPE data pins the affected code bases to cpe:2.3:a:cisco:cisco_identity_services_engine_software and cpe:2.3:a:cisco:cisco_ise_passive_identity_connector, and the independent assessment rates confidentiality impact as Low with no integrity or availability impact, meaning the technique yields file reads only - there is no arbitrary write, code execution or denial-of-service component in the assessed exploitation path. The vendor, Cisco, is the reporting source and the Cisco Security Advisory (cisco-sa-ise-multi-traversal-WDTgYCdn, mirrored in ENISA EUVD as EUVD-2026-81144) is the authoritative reference.
Know when Cisco Identity Services Engine Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network path traversal (AV:N/AC:L/PR:N/UI:N) yielding read of protected files maps to C:L; no integrity or availability impact, so I:N/A:N (differs from vendor's C:N/I:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device.
This vulnerability is due to insufficient validation of directory traversal character sequences in a user-supplied path when the software processes provisioning resource requests. An attacker could exploit this vulnerability by sending a crafted request to the provisioning download service. A successful exploit could allow the attacker to access protected files without authentication, potentially exposing sensitive information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Exploit-DB