EUVD-2026-81148
GHSA-5v2c-vx9c-jf32
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Network API reachable with low complexity but requires admin credentials (PR:H); I:H for data modification and C:L reflecting the description's data-viewing claim despite the vendor's C:N.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device.
This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
AnalysisAI
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid administrative credentials on the Cisco ISE or ISE-PIC device (CVSS PR:H) - this is the primary limiting factor, restricting the attack to authenticated administrators or attackers who have already compromised an admin account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine integrity-focused vulnerability but sits well below the critical tier once all signals are weighed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released fixed version is enumerated in the supplied data (patch status not confirmed from available input), so the first action is to open the Cisco Security Advisory cisco-sa-ise-multisql-inject-JnHK54Rq at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multisql-inject-JnHK54Rq to obtain the exact patched ISE and ISE-PIC releases for each 3.1/3.2/3.3/3.4/3.5 train and schedule an upgrade; tracking the EUVD record EUVD-2026-81148 and NVD entry for CVE-2026-76449 will surface the fixed versions when they are published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web servic
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Co
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only A
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Rea
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-P
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) all
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today