This vulnerability in Cisco ISE and ISE-PIC is caused by inadequate validation of user-supplied input before it is incorporated into database queries, leading to SQL or HQL injection risks. An attacker with valid administrative credentials can send crafted requests to execute arbitrary queries on the underlying database, potentially altering or accessing unauthorized data. The CVSS 3.1 base score is 4.9 (medium), reflecting the requirement for high privileges and lack of impact on confidentiality but high impact on integrity.

An attacker with valid administrative credentials can exploit this vulnerability to execute arbitrary SQL or HQL queries on the affected device's database. This could allow unauthorized modification of data, compromising data integrity. There is no indication of impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity involving database queries. No official fix or workaround information is provided in the current data.