According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities.

  - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL     injection attacks against the backend database. This vulnerability is due to insufficient validation of     certain parameters that are concatenated directly into an SQL query. An attacker could exploit this     vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A     successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct     server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid     administrative credentials. (CVE-2026-76425)

  - A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or     copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file     operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A     successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary     commands as root on the affected device.To exploit this vulnerability, the attacker must have valid     administrative credentials. (CVE-2026-76424)

  - A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote     attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to     insufficient validation of specific parameters that are then concatenated into an SQL statement. An     attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one     of the affected parameters. A successful exploit could allow the attacker to read information from the     monitoring database. To exploit this vulnerability, the attacker must have valid administrative     credentials. (CVE-2026-76426)

  - A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote     attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the     parsing of attacker-controlled feed metadata with an XML parser that does not disable external entity     resolution. An attacker could exploit this vulnerability by uploading a crafted offline feed package     through the administrative interface. A successful exploit could allow the attacker to read arbitrary     files from the file system and issue requests to internal systems from the affected device. To exploit     this vulnerability, the attacker must have valid administrative credentials. (CVE-2026-76427)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

high Nessus Plugin ID 348154

Version 1.3

Version 1.1

Version 1.3 Sep 21, 2026, 3:50 PM CVSSv2 score source (changed from "CVE-2026-76425" to "CVE-2026-76424") CVSSv3 score source (set to "CVE-2026-76425") Metadata (Add IAVM info) Plugin Feed: 202609211550
Version 1.1 Sep 18, 2026, 11:05 PM New Plugin Feed: 202609182305