OTPulse

Cisco Identity Services Engine Vulnerabilities

Plan PatchCVSS 10cisco-sa-ise-multi-hrP9jQSQSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) allow remote attackers to bypass authentication to the REST API without credentials, achieve remote code execution, perform SQL injection against the database, and conduct XML External Entity injection attacks. Affected versions are ISE 3.1.0 through 3.5.0.

What this means
What could happen
An attacker could bypass authentication to the REST API, execute arbitrary commands on your ISE device, extract or modify database contents via SQL injection, or read sensitive files through XML injection. This could allow complete compromise of your identity and access control infrastructure.
Who's at risk
Authentication and identity infrastructure operators: network administrators managing Cisco ISE deployments who rely on ISE for 802.1X authentication, guest access, and network access control across switches, wireless controllers, and VPN appliances. Any organization using ISE for enterprise access policy enforcement should treat this as critical.
How it could be exploited
An attacker on the network sends a crafted request to the ISE REST API, exploiting one of the authentication bypass vulnerabilities (no authentication required). The attacker then leverages remote code execution to run commands on the ISE device, or uses SQL injection/XML External Entity injection to access or alter configuration and user data.
Prerequisites
  • Network access to ISE REST API (typically port 443)
  • No authentication credentials required
remotely exploitableno authentication requiredlow complexityhigh CVSS score (10.0)affects critical authentication infrastructuremultiple attack vectors (RCE, SQL injection, XML injection)
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (1)
ProductAffected VersionsFix Status
Cisco Identity Services Engine3.1.0 through 3.5.0Fix available
Remediation & Mitigation
0/3
Do now
0/2
HOTFIXUpgrade Cisco ISE to version 3.5.1 or later (or the latest patch version for your release)
WORKAROUNDRestrict network access to ISE REST API ports to only authorized management networks and applications
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate ISE from untrusted networks
View full vendor advisory
API: /api/v1/advisories/b58c3488-e599-499d-9a14-c9d19a2ed7b5

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Identity Services Engine Vulnerabilities | CVSS 10 - OTPulse