Cisco ISE EUVD-2026-81148

Exploitation requires valid administrative credentials on the Cisco ISE or ISE-PIC device (CVSS PR:H) - this is the primary limiting factor, restricting the attack to authenticated administrators or attackers who have already compromised an admin account. Given that access, the attacker sends a crafted request to affected APIs that build SQL or HQL queries from insufficiently validated user input; no user interaction and no non-default configuration are stated to be required. The vulnerability affects Cisco ISE Software and ISE Passive Identity Connector across 3.1 through 3.5 trains as enumerated in EUVD.

This is a genuine integrity-focused vulnerability but sits well below the critical tier once all signals are weighed. The CVSS 3.1 base of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) is dominated by the PR:H requirement - Cisco explicitly states the attacker must already hold valid administrative credentials - which sharply narrows the realistic threat population to insiders or attackers who have already compromised an admin account. No EPSS score, KEV listing, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active or automated exploitation. Note a discrepancy worth flagging: the description says a successful exploit could 'view or modify data,' yet the vendor vector sets C:N (no confidentiality impact) and scores only I:H - the view-data claim implies at least some confidentiality exposure, so the confidentiality metric may be understated; verify with Cisco. On balance this is a real but lower-priority patch item - meaningful because ISE is a security-control plane, but heavily gated by the admin-credential prerequisite.

An attacker who has obtained valid Cisco ISE administrative credentials (or a malicious insider admin) sends a crafted request to a vulnerable API endpoint whose parameters are concatenated into a SQL or HQL query without sufficient validation. The injected query lets them read or alter database records beyond their authorized scope. No public exploit code is identified at time of analysis, and exploitation cannot occur without the required administrative credentials.