Cisco ISE EUVD-2026-81145

Requires valid administrative credentials for Cisco ISE or ISE-PIC (PR:H) - the description explicitly states 'the attacker must have valid administrative credentials.' Exploitation is network-remote against the REST APIs (AV:N) with low complexity (AC:L) and no user interaction, but is gated entirely by prior administrative authentication. Affected: Cisco ISE and ISE-PIC releases 3.1 through 3.5. Impact is limited to reading the session database (C:H, no write or availability impact). The high-privilege prerequisite is the dominant limiting factor: only an actor who already has admin access can exploit it, reducing this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector.

This is a genuinely lower-priority issue despite affecting a critical enterprise product. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9 Medium) tells the real story: PR:H means the attacker must already hold valid administrative credentials, which sharply narrows the realistic threat population. Impact is confidentiality-only (C:H, I:N, A:N) - the flaw permits reading from the session database but no data modification or availability loss, consistent with the description's 'read information from the session database.' No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation. There is no SSVC data supplied. The signals are internally consistent: a network-reachable but high-privilege, read-only SQL injection. The main caveat is the semantic mismatch typical of these authenticated flaws - an admin already able to query ISE via authorized means gains limited additional value from SQLi, so the practical risk is post-compromise data exfiltration or lateral escalation rather than initial access. Contrast with the unauthenticated ISE SQLi CVE-2026-20247 (PR:N), which is a far higher real-world priority.

An attacker who has already obtained valid ISE administrative credentials (via phishing, credential reuse, or an insider) sends a crafted REST API request embedding SQL statements in a vulnerable, unparameterized parameter. The injected SQL executes against the session database, letting the attacker read session records beyond what the API normally exposes. No public exploit code was identified at time of analysis, and successful use requires the attacker to first hold administrative access.