OTPulse

Cisco Identity Services Engine SQL and HQL Injection Vulnerabilities

MonitorCVSS 4.9cisco-sa-ise-multisql-inject-JnHK54RqSep 16, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

Multiple SQL and HQL injection vulnerabilities exist in Cisco ISE and ISE-PIC due to insufficient input validation in APIs that build database queries. An authenticated attacker with administrative credentials could send crafted requests to execute arbitrary SQL or HQL queries against the underlying database, allowing them to view or modify unauthorized data. Affected versions: 3.1.0 through 3.5.0. Cisco has released software updates to address these issues.

What this means
What could happen
An attacker with administrative credentials could inject SQL or HQL commands into the ISE database, allowing them to view or modify data they should not access, including authentication records, user information, and system configurations.
Who's at risk
Identity and Access Management administrators responsible for Cisco ISE deployments. ISE is commonly used in municipal utilities and water authorities to control network access for employees, contractors, and IoT devices. Compromise could expose employee credentials, contractor access logs, and network policy configurations used to grant access to control systems.
How it could be exploited
An attacker with valid admin credentials sends a specially crafted API request containing SQL or HQL injection payloads to the ISE appliance. The vulnerable APIs fail to validate the input before building database queries, allowing the attacker to execute arbitrary commands against the underlying database.
Prerequisites
  • Valid administrative credentials for Cisco ISE
  • Network access to ISE management interface (typically port 443)
  • ISE running version 3.1.0 through 3.5.0
Requires valid administrative credentialsLow EPSS score (0.3%)No workarounds availableAffects network access control system
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Cisco Identity Services Engine SQL and HQL Injection3.1.0 through 3.5.0Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco ISE to a patched version released after September 16, 2026 that addresses SQL/HQL injection vulnerabilities
View full vendor advisory
API: /api/v1/advisories/0478796d-4a29-4823-bc13-13d5a79b6c21

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.