OTPulse

Cisco Identity Services Engine Authorization Bypass Vulnerabilities

MonitorCVSS 4.3cisco-sa-ise-auth-bypass-1-MxcTNgwxSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Multiple authorization bypass vulnerabilities exist in the web-based management interface of Cisco Identity Services Engine (ISE) versions 3.1.0 through 3.5.0 and Cisco ISE Passive Identity Connector (ISE-PIC). These vulnerabilities stem from insufficient server-side validation of administrator permissions. An authenticated remote attacker with valid administrator credentials could submit a crafted HTTP request to modify configuration settings, including file descriptions and other configuration elements on affected systems. Cisco has released software updates to address these vulnerabilities.

What this means
What could happen
An attacker with administrator credentials could modify configuration settings on Cisco ISE, potentially altering file descriptions and other configuration details that could affect the integrity of identity authentication and authorization policies.
Who's at risk
Organizations operating Cisco Identity Services Engine (ISE) for centralized authentication and authorization, including network access control, guest management, and endpoint compliance. This affects ISE deployments used in enterprise networks for identity management and policy enforcement.
How it could be exploited
An attacker with valid administrator credentials sends a specially crafted HTTP request to the ISE web-based management interface, exploiting insufficient server-side validation of permissions. The server accepts the request and allows modification of configuration elements without properly verifying the attacker's authorization.
Prerequisites
  • Valid Cisco ISE administrator credentials
  • Network access to the ISE web-based management interface (typically port 443)
  • Administrator role privileges in ISE
Requires valid administrator credentialsLow CVSS score (4.3)Low exploit probability (0.4%)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Cisco Identity Services Engine3.1.0 through 3.5.0Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco Identity Services Engine to version 3.5.1 or later
View full vendor advisory
API: /api/v1/advisories/32ddd6e8-e3e7-4866-b5de-c4bf68d7d8ee

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.