Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

high Nessus Plugin ID 348154

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities.

- A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials. (CVE-2026-76425)

- A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device.To exploit this vulnerability, the attacker must have valid administrative credentials. (CVE-2026-76424)

- A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL statement. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the monitoring database. To exploit this vulnerability, the attacker must have valid administrative credentials. (CVE-2026-76426)

- A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package through the administrative interface. A successful exploit could allow the attacker to read arbitrary files from the file system and issue requests to internal systems from the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. (CVE-2026-76427)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwu20156, CSCwu26054, CSCwu26055, CSCwu27428, CSCwu39998, CSCwu43502

Plugin Details

Severity: High

ID: 348154

File Name: cisco-sa-ise-multi-hrP9jQSQ_CVE-2026-76424_CVE-2026-76425_CVE-2026-76426_CVE-2026-76427.nasl

Version: 1.1

Type: Local

Family: CISCO

Published: 9/18/2026

Updated: 9/18/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.26

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-76425

CVSS v3

Risk Factor: High

Base Score: 7.6

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:identity_services_engine, cpe:/a:cisco:identity_services_engine_software, cpe:/h:cisco:identity_services_engine

Required KB Items: Host/Cisco/ISE/version

Exploit Ease: No known exploits are available

Patch Publication Date: 9/16/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-76424, CVE-2026-76425, CVE-2026-76426, CVE-2026-76427

CWE: 23, 290, 611

CISCO-SA: cisco-sa-ise-multi-hrP9jQSQ

CISCO-BUG-ID: CSCwu20156, CSCwu26054, CSCwu26055, CSCwu27428, CSCwu39998, CSCwu43502

Detections

Analytics