Cisco ISE EUVD-2026-81156

Requires an authenticated session on the Cisco ISE / ISE-PIC web-based management interface with administrative-level privileges (PR:H) - this is the primary limiter and means the attacker must already hold or hijack an admin account. Exploitation is performed by uploading a crafted file whose user-supplied file path contains directory-traversal character sequences that the upload process fails to validate. No user interaction, no non-default configuration, and no adjacency are required beyond network reachability to the management interface; affected releases span ISE and ISE-PIC 3.1 through 3.5.

Severity signals are modest and internally consistent. The CVSS 3.1 base of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable but strongly gated flaw: exploitation requires PR:H, i.e. existing administrative-level credentials on the ISE/ISE-PIC web management interface, which is the dominant limiting factor. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so this is 'no public exploit identified at time of analysis' - not active exploitation. The C:N/I:H/A:N vector is honest about impact being integrity-only (arbitrary file write) with no direct confidentiality or availability loss claimed, though in practice writing to an arbitrary location on an appliance as an admin can plausibly escalate to configuration tampering or code execution - Cisco conservatively scored it as integrity-only. No signals conflict. Net: this is a genuine but lower-priority issue - the PR:H prerequisite means an attacker must already hold admin rights, so it is primarily a post-compromise or malicious-insider escalation primitive rather than a standalone remote threat. It sits in the same grouped advisory (cisco-sa-ise-multi-traversal-WDTgYCdn) as sibling ISE traversal CVEs.

An attacker who already possesses administrative credentials to the Cisco ISE/ISE-PIC web management interface (for example a rogue admin, or an attacker who has phished/hijacked an admin session) uploads a crafted file whose path contains directory-traversal sequences. Because the upload process does not validate the traversal characters, the file is written to an arbitrary location on the appliance, enabling configuration or system-file tampering. No public exploit code is identified at time of analysis.