Cisco Identity Services Engine Software
Monthly
SQL injection in Cisco Identity Services Engine (ISE) 3.1.0 through 3.5 lets an authenticated attacker with low-privileged administrative credentials read or modify data in the underlying database by sending a single crafted request to the management interface; no user interaction is required and the vector is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1). Because exploitation is gated behind valid administrative credentials, the practical exposure depends heavily on how tightly ISE management and API interfaces are restricted to trusted admin networks. Integrity impact is rated High while confidentiality is Low and availability is unaffected, so the realistic worst case is unauthorized tampering with - rather than mass exfiltration or denial of service of - ISE-stored data; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in the management APIs of Cisco Identity Services Engine (ISE) allows an authenticated administrator to read arbitrary content from the backend database and to pivot into server-side request forgery (SSRF) against internal services reachable from the ISE node. The flaw stems from insufficient validation of certain API parameters that are concatenated directly into a backend SQL query, and it affects ISE 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5.x releases enumerated by EUVD. Exploitation requires valid administrative credentials (CVSS PR:H, scope-changed S:C, confidentiality High), so this is a genuine but privilege-gated issue best treated as a post-compromise or insider-abuse vector; no public exploit code and no confirmed active exploitation were identified at time of analysis.
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Path traversal in the Cisco Identity Services Engine (ISE) REST API allows an attacker with valid administrative credentials to write files to arbitrary filesystem locations and ultimately execute commands as root on the appliance. The flaw stems from insufficient validation of file paths in upload or copy operations (CWE-23), and exploitation requires network reachability to the ISE REST API plus high-privileged credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2), so it is gated to authenticated insiders or post-compromise attackers rather than unauthenticated outsiders. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated remote SQL injection in Cisco ISE 3.1.x through 3.5.x allows a network attacker to modify data in the product's underlying database via a crafted request, per CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The flaw is CWE-89 improper neutralization of special elements in SQL, and Cisco's advisory plus ENISA EUVD list numerous 3.1.0-3.5 patch levels as affected. No public exploit was identified at time of analysis, and no KEV signal was supplied; the assessed limiting factor is network reachability to ISE management or service interfaces.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.
Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). Impact is availability-only and the node recovers on its own, but in single-node deployments endpoints that have not already authenticated cannot reach the network for the duration of the outage, whereas multi-node clusters limit the blast radius.
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator to execute arbitrary OS commands and escalate to root by sending a crafted HTTP request. The provided data identifies affected Cisco ISE software via CPE and notes that in single-node deployments exploitation can also render the node unavailable, causing a DoS condition that blocks unauthenticated endpoints from reaching the network until the node is restored. No public exploit identified at time of analysis; exploitation requires valid high-privileged administrative credentials, which sharply limits the threat despite the 9.1 CVSS score.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. Real-world risk is primarily limited by network exposure, as ISE management and service interfaces are typically deployed on protected management networks.
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to execute arbitrary operating system commands via crafted HTTP requests, resulting in full root access. The vulnerability, rated 9.9 (Critical), impacts multiple ISE versions; in single-node deployments, the affected device may become unavailable, causing denial of service. No active exploitation (KEV) or public exploit code has been identified, and the EPSS score of 0.21% indicates low likelihood of widespread attacks.
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only Admin credentials run arbitrary OS commands and escalate to root by sending a crafted HTTP request. The flaw stems from insufficient validation of user-supplied input (CWE-77); on single-node deployments a successful exploit can also crash the node, blocking network authentication for not-yet-authenticated endpoints. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. Cisco is the reporting vendor and a consolidated advisory is available; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the high privilege prerequisite keeps the issue bounded to a Medium risk rating.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Missing server-side validation of administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) lets an authenticated, remote administrative user modify configuration content that should be gated behind a higher privilege level, specifically the descriptions of files on one particular page. Only ISE deployments exposing the management interface to a reachable network are affected, and exploitation requires a valid administrative credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so confidentiality and availability are untouched and only a narrow integrity element is at risk. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS signal was not provided; despite the 'Authentication Bypass' tag attached to this record by some feeds, the flaw is an authorization-enforcement gap rather than a way to authenticate without credentials.
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. Impact is limited to confidentiality (C:H, no integrity or availability effect, CVSS 4.9 / PR:H), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but tightly-gated confidentiality issue rather than a broad emergency, and should be prioritized behind perimeter-critical exposures while still being remediated promptly because the disclosed data includes credentials.
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. The dominant limiting factor is the PR:H administrator-credential prerequisite, which makes this a trusted-insider or post-credential-compromise concern rather than a pre-auth remote threat; no public exploit code and no evidence of active exploitation (not listed in CISA KEV) were identified at time of analysis.
Session hijacking in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to spoof a legitimate user mid-onboarding and take over that user's session, ultimately gaining access to protected 802.1X networks. The root cause is an authentication bypass by spoofing (CWE-290): insufficient authentication checks during onboarding let the attacker trigger a redirection to the guest web portal and bind their device to the victim's in-flight session. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, score 3.8) confirms no credentials are required but that the attacker must be on the same Layer-2 segment and a genuine user must be actively onboarding; this is a deliberately disabled-by-default optional NAC feature rather than a baseline ISE capability, so real-world exploitability is narrow. No public exploit code and no active exploitation have been identified at time of analysis, and no EPSS signal was provided with the source data.
Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
Authenticated remote attackers holding valid administrative credentials can read sensitive data - including hashed credentials usable in follow-on attacks - from Cisco Identity Services Engine (ISE) by sending a single crafted API request that is improperly validated and reaches the backend as SQL (CWE-89). The flaw affects ISE Software across the 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5 branches at numerous patch levels; exploitation requires administrator-level privileges (PR:H) but no user interaction, and the API is network-reachable. Cisco's own CVSS of 4.9 (Medium) is a credible ceiling rather than an understatement, because the high-privilege prerequisite sharply limits who can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). Exploitation requires user interaction (UI:R) against a legitimate interface user, so exposure drops sharply if the admin interface is not reachable from untrusted networks; at time of analysis there is no CISA KEV entry and no public exploit code identified, although the affected version list is broad, covering ISE 3.1.0 through 3.5 releases.
SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Remote, authenticated administrators of Cisco Identity Services Engine (ISE) can escalate from the web management interface to write access on the appliance's underlying operating system by sending a single crafted HTTP request, and Cisco confirms root is easy to reach from that primitive, making the practical outcome full device compromise. The flaw is improper restriction of resource/file names (CWE-641) in the ISE management web/API layer, reachable over the network with no user interaction but requiring valid administrative credentials (CVSS 3.1 PR:H), so it is a post-authentication escalation path rather than a pre-auth entry point. Cisco's published base score of 4.9 (Medium) understates the outcome - the vendor assigned a High Security Impact Rating for exactly this reason, and our independent assessment raises confidentiality, integrity and availability impact to High; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. Although the CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), Cisco has explicitly assigned a Security Impact Rating of High because of the short path from the achieved privilege level to root, making the raw numeric score a poor indicator of real-world severity.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADIUS Policy API endpoints and gain unauthorized read access to sensitive policy details through direct API calls. The vulnerability affects ISE software across versions due to improper RBAC enforcement on API endpoints, enabling privilege escalation from read-only to unauthorized data disclosure. CVSS score is 4.3 with low attack complexity, but exploitation requires valid administrative credentials.
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to inject and execute arbitrary commands on the underlying operating system. This command injection flaw stems from insufficient input validation in a specific CLI command, granting full control of the network access control appliance. No public exploit or active exploitation has been identified, and the EPSS score of 0.05% indicates very low likelihood of widespread exploitation.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
Stored and reflected cross-site scripting vulnerabilities in Cisco Identity Services Engine's web-based management interface allow an authenticated attacker holding administrative write privileges to inject malicious JavaScript that executes in the context of other users' browsers. Affected releases span ISE 3.1 through 3.4 (including multiple patch releases). No active exploitation has been identified and no public exploit code exists; the EPSS score of 0.03% and SSVC exploitation status of 'none' align with the high privilege bar required.
SQL injection in Cisco Identity Services Engine (ISE) 3.1.0 through 3.5 lets an authenticated attacker with low-privileged administrative credentials read or modify data in the underlying database by sending a single crafted request to the management interface; no user interaction is required and the vector is network-reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1). Because exploitation is gated behind valid administrative credentials, the practical exposure depends heavily on how tightly ISE management and API interfaces are restricted to trusted admin networks. Integrity impact is rated High while confidentiality is Low and availability is unaffected, so the realistic worst case is unauthorized tampering with - rather than mass exfiltration or denial of service of - ISE-stored data; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in the management APIs of Cisco Identity Services Engine (ISE) allows an authenticated administrator to read arbitrary content from the backend database and to pivot into server-side request forgery (SSRF) against internal services reachable from the ISE node. The flaw stems from insufficient validation of certain API parameters that are concatenated directly into a backend SQL query, and it affects ISE 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5.x releases enumerated by EUVD. Exploitation requires valid administrative credentials (CVSS PR:H, scope-changed S:C, confidentiality High), so this is a genuine but privilege-gated issue best treated as a post-compromise or insider-abuse vector; no public exploit code and no confirmed active exploitation were identified at time of analysis.
SQL injection in the SXP REST API of Cisco Identity Services Engine (ISE) lets a remote attacker who already holds valid administrative credentials on the node read or modify records in the underlying database, and on single-node deployments can render the ISE node unavailable so that endpoints that have not yet authenticated cannot reach the network until it is restored. Exploitation is not opportunistic: it requires the optional SXP (Security Group Tag Exchange Protocol) service to be enabled and at least one SXP connection to be configured, which confines realistic risk to TrustSec deployments that use SXP and whose admin accounts are exposed. Cisco rates the issue 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Path traversal in the Cisco Identity Services Engine (ISE) REST API allows an attacker with valid administrative credentials to write files to arbitrary filesystem locations and ultimately execute commands as root on the appliance. The flaw stems from insufficient validation of file paths in upload or copy operations (CWE-23), and exploitation requires network reachability to the ISE REST API plus high-privileged credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2), so it is gated to authenticated insiders or post-compromise attackers rather than unauthenticated outsiders. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthenticated remote SQL injection in Cisco ISE 3.1.x through 3.5.x allows a network attacker to modify data in the product's underlying database via a crafted request, per CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The flaw is CWE-89 improper neutralization of special elements in SQL, and Cisco's advisory plus ENISA EUVD list numerous 3.1.0-3.5 patch levels as affected. No public exploit was identified at time of analysis, and no KEV signal was supplied; the assessed limiting factor is network reachability to ISE management or service interfaces.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.
Denial of service in Cisco Identity Services Engine (ISE) RADIUS handling allows an unauthenticated, remote attacker to make an affected ISE node unavailable by sending a single crafted RADIUS request directly to the device (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H; CWE-119). Every ISE release from 3.2.0 through 3.5 is reported as affected, including numerous 3.2, 3.3 and 3.4 patch levels; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (no CISA KEV listing). Impact is availability-only and the node recovers on its own, but in single-node deployments endpoints that have not already authenticated cannot reach the network for the duration of the outage, whereas multi-node clusters limit the blast radius.
Command injection in Cisco Identity Services Engine (ISE) allows an authenticated, high-privileged remote administrator to execute arbitrary OS commands and escalate to root by sending a crafted HTTP request. The provided data identifies affected Cisco ISE software via CPE and notes that in single-node deployments exploitation can also render the node unavailable, causing a DoS condition that blocks unauthenticated endpoints from reaching the network until the node is restored. No public exploit identified at time of analysis; exploitation requires valid high-privileged administrative credentials, which sharply limits the threat despite the 9.1 CVSS score.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. Real-world risk is primarily limited by network exposure, as ISE management and service interfaces are typically deployed on protected management networks.
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.
Remote code execution and privilege escalation in Cisco Identity Services Engine allows authenticated attackers with Read Only Admin privileges to execute arbitrary operating system commands via crafted HTTP requests, resulting in full root access. The vulnerability, rated 9.9 (Critical), impacts multiple ISE versions; in single-node deployments, the affected device may become unavailable, causing denial of service. No active exploitation (KEV) or public exploit code has been identified, and the EPSS score of 0.21% indicates low likelihood of widespread attacks.
Command injection in Cisco Identity Services Engine (ISE) lets an authenticated remote attacker holding only Read-Only Admin credentials run arbitrary OS commands and escalate to root by sending a crafted HTTP request. The flaw stems from insufficient validation of user-supplied input (CWE-77); on single-node deployments a successful exploit can also crash the node, blocking network authentication for not-yet-authenticated endpoints. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. Cisco is the reporting vendor and a consolidated advisory is available; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the high privilege prerequisite keeps the issue bounded to a Medium risk rating.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
Missing server-side validation of administrator permissions in the web-based management interface of Cisco Identity Services Engine (ISE) lets an authenticated, remote administrative user modify configuration content that should be gated behind a higher privilege level, specifically the descriptions of files on one particular page. Only ISE deployments exposing the management interface to a reachable network are affected, and exploitation requires a valid administrative credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base score 4.3), so confidentiality and availability are untouched and only a narrow integrity element is at risk. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS signal was not provided; despite the 'Authentication Bypass' tag attached to this record by some feeds, the flaw is an authorization-enforcement gap rather than a way to authenticate without credentials.
Authenticated Cisco Identity Services Engine (ISE) administrators who hold delegated management rights over network users can abuse the platform's user-export function to read records - including normally hidden user passwords - belonging to security groups they are not assigned to, because the files backing that export lack proper authorization enforcement. The issue affects ISE 3.1 through 3.5 (and equivalent ISE-PIC deployments) at the patch levels enumerated in the Cisco advisory, and requires a valid high-privileged account with user-management delegation plus access to the web-based management interface; unauthenticated, read-only, or otherwise unprivileged users cannot trigger it. Impact is limited to confidentiality (C:H, no integrity or availability effect, CVSS 4.9 / PR:H), and no public exploit code or confirmed active exploitation was identified at time of analysis. This is a genuine but tightly-gated confidentiality issue rather than a broad emergency, and should be prioritized behind perimeter-critical exposures while still being remediated promptly because the disclosed data includes credentials.
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. The dominant limiting factor is the PR:H administrator-credential prerequisite, which makes this a trusted-insider or post-credential-compromise concern rather than a pre-auth remote threat; no public exploit code and no evidence of active exploitation (not listed in CISA KEV) were identified at time of analysis.
Session hijacking in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to spoof a legitimate user mid-onboarding and take over that user's session, ultimately gaining access to protected 802.1X networks. The root cause is an authentication bypass by spoofing (CWE-290): insufficient authentication checks during onboarding let the attacker trigger a redirection to the guest web portal and bind their device to the victim's in-flight session. The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, score 3.8) confirms no credentials are required but that the attacker must be on the same Layer-2 segment and a genuine user must be actively onboarding; this is a deliberately disabled-by-default optional NAC feature rather than a baseline ISE capability, so real-world exploitability is narrow. No public exploit code and no active exploitation have been identified at time of analysis, and no EPSS signal was provided with the source data.
Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
Authenticated remote attackers holding valid administrative credentials can read sensitive data - including hashed credentials usable in follow-on attacks - from Cisco Identity Services Engine (ISE) by sending a single crafted API request that is improperly validated and reaches the backend as SQL (CWE-89). The flaw affects ISE Software across the 3.1.x, 3.2.x, 3.3.x, 3.4.x and 3.5 branches at numerous patch levels; exploitation requires administrator-level privileges (PR:H) but no user interaction, and the API is network-reachable. Cisco's own CVSS of 4.9 (Medium) is a credible ceiling rather than an understatement, because the high-privilege prerequisite sharply limits who can trigger it; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
Reflected cross-site scripting in the web-based management interface of Cisco Identity Services Engine (ISE) lets a remote, unauthenticated attacker execute arbitrary script code in the browser session of an ISE interface user who is persuaded to click a crafted link (CVSS 3.1 base 6.1, CWE-79). Successful exploitation is confined to the victim's browser context - the attacker can read browser-based information or act as the interface user, but there is no server-side code execution and no availability impact (C:L/I:L/A:N). Exploitation requires user interaction (UI:R) against a legitimate interface user, so exposure drops sharply if the admin interface is not reachable from untrusted networks; at time of analysis there is no CISA KEV entry and no public exploit code identified, although the affected version list is broad, covering ISE 3.1.0 through 3.5 releases.
SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Remote, authenticated administrators of Cisco Identity Services Engine (ISE) can escalate from the web management interface to write access on the appliance's underlying operating system by sending a single crafted HTTP request, and Cisco confirms root is easy to reach from that primitive, making the practical outcome full device compromise. The flaw is improper restriction of resource/file names (CWE-641) in the ISE management web/API layer, reachable over the network with no user interaction but requiring valid administrative credentials (CVSS 3.1 PR:H), so it is a post-authentication escalation path rather than a pre-auth entry point. Cisco's published base score of 4.9 (Medium) understates the outcome - the vendor assigned a High Security Impact Rating for exactly this reason, and our independent assessment raises confidentiality, integrity and availability impact to High; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV.
OS command injection in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker holding valid administrative credentials to run arbitrary commands on the underlying operating system, and Cisco notes the obtained privilege level can be escalated easily to root. Exploitation is constrained to ISE nodes that have more than one network interface and that have one of those interfaces configured as an active IPsec tunnel, so default single-interface deployments without IPsec are not exposed; no public exploit code was identified at time of analysis. Although the CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N), Cisco has explicitly assigned a Security Impact Rating of High because of the short path from the achieved privilege level to root, making the raw numeric score a poor indicator of real-world severity.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADIUS Policy API endpoints and gain unauthorized read access to sensitive policy details through direct API calls. The vulnerability affects ISE software across versions due to improper RBAC enforcement on API endpoints, enabling privilege escalation from read-only to unauthorized data disclosure. CVSS score is 4.3 with low attack complexity, but exploitation requires valid administrative credentials.
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
Privilege escalation to root in Cisco ISE CLI allows an authenticated local attacker with administrative privileges to inject and execute arbitrary commands on the underlying operating system. This command injection flaw stems from insufficient input validation in a specific CLI command, granting full control of the network access control appliance. No public exploit or active exploitation has been identified, and the EPSS score of 0.05% indicates very low likelihood of widespread exploitation.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
Stored and reflected cross-site scripting vulnerabilities in Cisco Identity Services Engine's web-based management interface allow an authenticated attacker holding administrative write privileges to inject malicious JavaScript that executes in the context of other users' browsers. Affected releases span ISE 3.1 through 3.4 (including multiple patch releases). No active exploitation has been identified and no public exploit code exists; the EPSS score of 0.03% and SSVC exploitation status of 'none' align with the high privilege bar required.