Cisco ISE EUVD-2026-81147

Exploitation requires valid administrative credentials on the affected Cisco ISE or ISE Passive Identity Connector device (CVSS PR:H) - this is the primary limiting factor and reduces the realistic attacker population to those with legitimate admin access or who have already compromised such an account. Beyond authentication, the attacker only needs network reach to the affected management APIs and no user interaction (UI:N). Affected releases span ISE/ISE-PIC 3.1 through 3.5 (including numerous patch levels per EUVD); there is no indication of a non-default configuration requirement - the vulnerable APIs appear present in standard deployments. The high administrative-privilege prerequisite is the key constraint defenders should weigh against the raw injection severity.

This is a genuine but low-urgency vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9) shows a network-reachable but heavily gated flaw: PR:H means the attacker must already hold valid administrative credentials on the ISE/ISE-PIC device. Cisco scores impact as integrity-only (I:H, C:N/A:N), meaning the vendor characterizes the outcome as unauthorized data modification rather than mass exfiltration or denial of service. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all three real-world exploitation signals are either absent or negative - no evidence of active or imminent exploitation. Note a discrepancy worth flagging: the description explicitly states an attacker could 'view or modify data,' which implies a confidentiality impact, yet the vendor vector sets C:N - verify with Cisco whether read-out is truly out of scope, because arbitrary SQL/HQL query execution typically enables data disclosure (C:H) as well. Overall this is a moderate, credential-gated post-authentication issue best triaged by patch cycle rather than as an emergency, given the high privilege prerequisite and lack of exploitation evidence.

An attacker who has already obtained valid administrative credentials for a Cisco ISE or ISE-PIC deployment (e.g., via credential theft, insider access, or a chained lower-privilege flaw) sends a crafted request to a vulnerable API endpoint. Insufficient input validation lets the crafted parameters alter the backend SQL or HQL query, allowing the attacker to read or modify database records outside their authorization boundary. No public proof-of-concept is currently available.