Cisco Ise Passive Identity Connector
Monthly
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. Real-world risk is primarily limited by network exposure, as ISE management and service interfaces are typically deployed on protected management networks.
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. Cisco is the reporting vendor and a consolidated advisory is available; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the high privilege prerequisite keeps the issue bounded to a Medium risk rating.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. The dominant limiting factor is the PR:H administrator-credential prerequisite, which makes this a trusted-insider or post-credential-compromise concern rather than a pre-auth remote threat; no public exploit code and no evidence of active exploitation (not listed in CISA KEV) were identified at time of analysis.
Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.
Authentication bypass in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector lets an unauthenticated, remote attacker reach a privileged API endpoint and gain unauthorized access to the appliance through its web-based management interface, with no credentials or user interaction required - reflected in a maximum CVSS score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exploitation is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, so any reachable ISE management/API plane should be treated as a top-priority emergency. Affected deployments span ISE 3.1.0 p8 through 3.5 Patch 3 and ISE-PIC 3.4.0 and 3.5.0.
Improper input validation in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative credentials to cause high confidentiality, integrity, and availability impact, with a scope change that may extend effects beyond the vulnerable component. Rated CVSS 9.1, this issue is moderated in practice by its PR:H prerequisite, which confines realistic exploitation to already-privileged insiders or post-compromise attackers; no public exploit code or active exploitation has been identified at time of analysis. Affected software is addressed by a Cisco hardening release, and the vendor advisory should be consulted for fixed releases.
Cisco ISE and Cisco ISE-PIC can be taken over by an unauthenticated, remote attacker who reaches the REST API web service, because that service fails to enforce adequate authorization checks before processing crafted HTTP requests. Successful exploitation grants administrative privileges over the appliance, allowing the attacker to read and modify policy configuration and identity data - a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) condition where no credentials or user interaction are required. The only meaningful barrier is network reachability: any ISE node whose REST API port is exposed to an untrusted segment is directly exploitable, so exposure is effectively the exploitability gate. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing), but the assessed impact and the value of ISE as a central identity/network-access control plane make this a top-priority item.
Remote, unauthenticated attackers with network access to Cisco Identity Services Engine (ISE) or ISE Passive Identity Connector (ISE-PIC) can achieve full compromise of the appliance due to multiple injection-class flaws (CWE-74) addressed in a hardening release, as reflected by a maximum CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and the vendor has not specified the exact triggering feature or protocol path, but the CVSS vector confirms no authentication, no user interaction, and low attack complexity are required. Real-world risk is primarily limited by network exposure, as ISE management and service interfaces are typically deployed on protected management networks.
Improper access control vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow unauthenticated remote attackers to bypass authentication and gain full control of affected deployments (CVSS 10.0). Cisco addressed these flaws in a software hardening release, and no public exploit has been identified at time of analysis. Affected versions are pre-hardening releases of ISE and ISE-PIC, though the specific triggering components are not disclosed due to the grouped nature of the advisory. This is the most severe member of the Cisco ISE hardening advisory family.
Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) contain multiple internally discovered vulnerabilities grouped under CVE-2026-20194, stemming from incorrect resource transfer between spheres (CWE-669). An authenticated attacker with high privileges can exploit these over the network to potentially achieve high confidentiality, integrity, and availability impact, as reflected by the CVSS 3.1 score of 9.1 (Critical) with scope change. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege authentication prerequisite confines realistic risk to trusted insiders or attackers who already hold administrative access.
Information disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows unauthenticated remote attackers to retrieve sensitive data - including hashed credentials - by sending crafted traffic to an affected device. The root cause is missing authorization checks on a protected resource (CWE-285), making this an authentication-bypass-style information leak. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote command execution in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows administrators to run arbitrary OS commands and escalate to root via a crafted HTTP request. The flaw, tracked as CVE-2026-20181 and reported by Cisco with a CVSS 3.1 score of 9.1 (scope-changed), can also crash single-node deployments and deny network access to unauthenticated endpoints. There is no public exploit identified at time of analysis.
Command injection in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (PIC) allows authenticated administrative attackers to execute arbitrary OS commands, achieving user-level access and privilege escalation to root. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints. No active exploitation has been observed and the low EPSS score suggests lower immediate risk.
SQL injection in the REST API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector lets a remote attacker who already holds valid administrative credentials inject SQL statements through insufficiently validated parameters and read information from the monitoring database. The vulnerability affects ISE and ISE-PIC releases 3.1.x through 3.5.x and carries a CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), meaning the impact is limited to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the dominant limiting factor is the high-privilege prerequisite, so realistic exposure is confined to insiders, stolen-credential scenarios, or post-compromise abuse by an already-privileged actor.
Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
XML external entity (XXE) injection in the offline profiler feed service of Cisco Identity Services Engine (ISE) allows an authenticated remote administrator to read arbitrary files from the appliance and to use it as a pivot for requests to internal systems. The flaw affects ISE and ISE Passive Identity Connector releases across the 3.1 through 3.5 trains, and exploitation requires high-privilege administrative credentials (CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) plus the ability to upload a crafted offline feed package through the administrative interface. Cisco is the reporting vendor and a consolidated advisory is available; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the high privilege prerequisite keeps the issue bounded to a Medium risk rating.
Missing authentication on a function of the Online Certificate Status Protocol (OCSP) responder in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an unauthenticated, remote attacker trigger an on-demand reload of the responder's certificate and key material. Affected deployments span essentially the current ISE 3.1 through 3.5 release trains and the corresponding ISE-PIC builds, with any host reachable to the OCSP responder service in scope. The impact is limited to a low-severity availability disruption (CVSS 3.1 base 5.3, A:L) with no confidentiality, integrity, or host-compromise consequence; no public exploit code or confirmed active exploitation was identified at time of analysis, and external risk scoring (EPSS) was not available in the supplied data.
Authenticated users holding administrator-tier accounts on Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can bypass server-side authorization checks in the web-based management interface to alter file descriptions on a specific configuration page. The issue is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N): it requires valid Administrator credentials and yields only a low-integrity change on a single page, with no confidentiality or availability impact and no privilege escalation. No CISA KEV listing and no public exploit code have been identified at time of analysis, so this is a low-severity, high-friction issue that does not warrant priority patching in isolation.
Improper privilege management in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) versions 3.1 through 3.5 allows a network-reachable attacker who already holds a high-privilege administrative account on the management plane to escalate their privileges within the product, per CVE-2026-20287 (CVSS 3.1 base 6.5, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). The flaw is one of several defects bundled into a Cisco internal-hardening release and is tracked under the CWE-269 improper privilege management pillar; the exact vulnerable sub-feature is not individually described in the grouped advisory. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); because the vector requires PR:H, this is a post-authentication privilege escalation affecting the appliance's administrative layer rather than an initial-access or unauthenticated remote code execution issue. For most organizations it represents a moderate-priority, defense-in-depth concern that is materially mitigated by keeping the ISE management interface off untrusted networks, though the potential for both confidentiality and integrity impact (C:H/I:H) still warrants prioritized patching on any ISE deployment that exposes its admin plane broadly or grants many staff high-privilege accounts.
File disclosure in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote attacker who already holds high-privilege administrative access to the management API to read files on the underlying operating system by sending a crafted XML request to a vulnerable API endpoint that fails to restrict external entity references (CWE-611). Cisco scored the issue CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); read scope is confined to files the ISE process itself can access, and there is no integrity or availability impact. The dominant limiting factor is the PR:H administrator-credential prerequisite, which makes this a trusted-insider or post-credential-compromise concern rather than a pre-auth remote threat; no public exploit code and no evidence of active exploitation (not listed in CISA KEV) were identified at time of analysis.
Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrative users of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) can exploit insufficient input validation in affected APIs to perform SQL/HQL injection, enabling them to view or modify unauthorized database data, with a high integrity impact and low confidentiality impact. The vulnerability affects ISE/ISE-PIC versions 3.1 through 3.5 and requires valid administrative credentials; no public exploit identified at time of analysis.
Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.
Missing authentication on the internal Policy Runtime Repository Table (PRRT) service in Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. The flaw is an instance of CWE-306 (missing authentication for a critical function) and carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting confidentiality-only impact with no modification or denial-of-service effect. Affected releases span ISE 3.4.0 through 3.4 Patch 6, ISE 3.5.0 through 3.5 Patch 3, and ISE-PIC 3.4.0/3.5.0; there is no public exploit identified at time of analysis. Real-world risk is tempered by the fact that the vulnerable PRRT service is internal, so exploitation depends entirely on an attacker gaining network reachability to that endpoint - segmentation of ISE management and internal interfaces sharply reduces exposure.
SQL and HQL injection in the management APIs of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, high-privileged administrator to execute arbitrary SQL or Hibernate Query Language statements against the product's underlying database, enabling access to or modification of data the attacker is not authorized to view or change. The flaw (CWE-564) stems from insufficient validation of user-supplied input passed to APIs that build database queries, and is reachable over the network without user interaction against affected 3.1 through 3.5 release trains; exploitation requires valid administrative credentials (CVSS 3.1 PR:H), which is the principal limiting factor. Cisco's advisory scores this 4.9 (Medium) using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, while the independent assessment rates confidentiality and integrity impact as High; no public exploit has been identified at time of analysis and there is no CISA KEV listing.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated, remote user with valid administrative credentials to submit crafted requests to affected APIs and run arbitrary SQL or HQL statements against the product's underlying database, giving them the ability to read or alter data they are not authorized to access. The vulnerability is rated CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N per independent assessment), with the high privilege requirement (PR:H) and the low confidentiality but high integrity impact being the defining characteristics; the affected code spans the 3.1, 3.2, 3.3, 3.4 and 3.5 release trains. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so the primary risk is insider or post-compromise abuse of administrative access rather than opportunistic external exploitation.
SQL and HQL injection in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) lets an authenticated remote attacker with administrative credentials execute arbitrary database queries against the underlying data store, potentially reading or modifying data outside their authorization. The flaw stems from insufficient validation of user-supplied input to affected management APIs before it is used to construct database queries, and it is exploitable over the network without user interaction (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N per independent assessment). The high-privilege prerequisite is the main limiting factor: no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS probability was supplied, making this a genuine but low-urgency issue for most deployments.
SQL injection in the REST APIs of Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC) allows an attacker who already holds valid administrative credentials to read information from the session database, with no integrity or availability impact. The vector is network-reachable, low complexity, and requires no user interaction, but the PR:H prerequisite confines this to a post-authentication data-disclosure/escalation concern rather than an initial-access vector. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; given the administrative credential requirement and read-only impact, this is a lower-priority issue despite the criticality of the affected product.
Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.
Unauthenticated remote attackers who can reach the Cisco Identity Services Engine guest portal can submit forged endpoint posture status events into ISE's posture pipeline, allowing manipulation of the posture state recorded for endpoints. The issue is an authentication gap (CWE-306) on an internal posture-status reporting interface that the guest portal exposes; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, privileges, or user interaction are required, and the assessed impact is integrity-only and low (C:N/I:L/A:N). Affected deployments span Cisco ISE Software 3.1 through 3.5 and the matching Cisco ISE Passive Identity Connector releases, and the practical exposure depends on whether the guest portal and posture assessment are enabled and reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows a remote, authenticated attacker with administrative credentials to read or delete arbitrary files on the underlying operating system via crafted HTTP requests. Successful exploitation could expose sensitive configuration or credential files, or trigger destructive deletion of system files. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and the critical role ISE plays in enterprise network access control make this notable for environments running affected versions.
Path traversal in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allows an authenticated administrator to read arbitrary files on the underlying operating system via crafted HTTP requests. The vulnerability requires valid administrative credentials. No public exploit code or active exploitation has been reported.