CVE-2026-76432
MediumCVSS 4.9Summary
Improper validation of directory traversal character sequences during file upload in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker with administrative privileges to write arbitrary files. A crafted file upload can write to arbitrary locations.
Risk Assessment
An attacker with administrative privileges could write files to arbitrary locations, potentially leading to code execution or persistent system compromise.
Recommendation
Apply Cisco patches, restrict administrative access, and monitor for unusual file upload activity.
Other vulnerabilities in Cisco ISE
See all- CVE-2026-76444Medium
A missing authentication vulnerability exists in the Policy Runtime Repository Table (PRRT) service of Cisco ISE and Cisco ISE-PIC. An unauthenticated remote attacker could send a crafted request to retrieve sensitive configuration information from an affected device.
- CVE-2026-76439Medium
Insufficient authentication on an internal interface exposed through the guest portal of Cisco ISE allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline. A crafted request can manipulate posture status on the affected system.
- CVE-2026-76434Medium
Insufficient validation of user-supplied input in the certificate import functionality of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files. A crafted request can expose sensitive information.
- CVE-2026-76433Medium
Insufficient validation of directory traversal character sequences in a user-supplied path in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to access protected files. A crafted request to the provisioning download service can expose sensitive information.
- CVE-2026-76431Medium
Improper validation of directory traversal character sequences in a user-supplied file path in the file management function of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to delete arbitrary files and directories. A crafted request can delete files on the underlying operating system.
- CVE-2026-76428Medium
SQL injection vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC due to certain parameters being concatenated directly into SQL clauses without parameterization. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the session database.
- CVE-2026-76427Medium
XML external entity vulnerability in the offline profiler feed service of Cisco ISE due to parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An authenticated remote attacker with administrative credentials can upload a crafted offline feed package to read arbitrary files and issue requests to internal systems.
- CVE-2026-76426Medium
SQL injection vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of specific parameters that are concatenated into an SQL statement. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the monitoring database.
- CVE-2026-76425High
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint.
- CVE-2026-76424High
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validate directory traversal character sequences in a user-supplied file path during the upload process. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to write files to an arbitrary location on the affected system.