Cisco ISE EUVD-2026-81157

Requires valid low-privileged administrative credentials to the Cisco ISE management interface (PR:L) - this is an authenticated attack, not exploitable by anonymous remote actors. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) to the ISE admin/API surface. The affected feature is an input-handling path that fails to validate user-supplied input before incorporating it into a database query; exploitation is via a single crafted request. Limiting factors: the authentication requirement and the assumption that management interfaces are network-restricted to trusted admin networks (a common ISE hardening practice), which further reduces realistic exposure. Affected releases span ISE 3.1 through 3.5 including numerous patch levels.

This is a genuine but access-gated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1) shows a network-reachable, low-complexity SQL injection, but PR:L is the decisive limiter: the attacker must already hold valid low-privileged administrative credentials on the ISE deployment, so this is a post-authentication privilege/data-integrity abuse, not an anonymous internet attack. No EPSS score, no CISA KEV listing, and no public POC were provided, so the correct exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or widespread exploitation. Signals are internally consistent (Cisco is the sole reporter, single advisory reference cisco-sa-ise-sql-inj-3QTKR947), with no conflict between the description and the vector. The primary impact skews to integrity (I:H - read or modify database contents) with limited confidentiality (C:L) and no availability impact, which fits a SQLi that can tamper with authorization/identity data. Bottom line: real priority for any org running Cisco ISE because it is core NAC/identity infrastructure and low-priv admin roles are commonly delegated, but the authentication precondition keeps it below the unauthenticated-critical tier.

An attacker who has obtained or been granted a low-privileged ISE admin account (e.g., a help-desk or read-oriented role) sends a crafted request containing malicious SQL to an affected web/API endpoint. Because user input is not properly validated, the injected SQL executes against the backend database, letting the attacker read sensitive records or modify identity/authorization data beyond their intended role. No public exploit code has been identified, so exploitation currently requires the attacker to develop the injection themselves.