Cisco Identity Services Engine Command Injection Vulnerabilities
Plan PatchCVSS 9.1cisco-sa-ise-cmd-inj-e2CuZCYZSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary
Multiple command injection vulnerabilities in Cisco Identity Services Engine (ISE) versions 3.1.0 through 3.5.0 and ISE Passive Identity Connector (ISE-PIC) allow an authenticated remote attacker with administrative credentials to execute arbitrary commands as the root user. The vulnerabilities result from insufficient input validation in the ISE management interface.
What this means
What could happen
An authenticated administrator with valid credentials could execute arbitrary commands as root on your Identity Services Engine, potentially compromising network access controls, authentication systems, and the integrity of all devices managed through this platform.
Who's at risk
Network administrators and security teams managing Cisco Identity Services Engine in enterprise environments, particularly utilities and critical infrastructure that rely on ISE for network access control, 802.1X authentication, and endpoint security policies.
How it could be exploited
An attacker with valid administrative credentials logs into the ISE management interface and injects malicious commands through input fields that are not properly sanitized. The commands execute as root on the ISE appliance, giving the attacker full control.
Prerequisites
- Valid administrative credentials for Cisco ISE
- Network access to the ISE management interface (typically port 443 HTTPS)
Remotely exploitableRequires valid administrative credentialsLow complexity exploitationAffects network authentication and access control systemsRoot-level code execution
Exploitability
Some exploitation risk — EPSS score 1.4%
Affected products (1)
ProductAffected VersionsFix Status
Cisco Identity Services Engine3.1.0 through 3.5.0Fix available
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict administrative access to ISE management interface to authorized personnel and limit source IPs using firewall rules
HARDENINGReview ISE administrative accounts and remove any unused or shared credentials
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Cisco ISE to version 3.5.1 or later
Long-term hardening
0/1HARDENINGMonitor ISE administrative access logs for unauthorized login attempts or suspicious command execution
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d56500f9-c1e6-4671-9629-8e29240c691bGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.