This vulnerability in Cisco ISE is caused by insecure deserialization of Java objects, enabling an authenticated remote attacker with high-privileged administrative credentials to execute arbitrary commands on the underlying OS. The attacker sends a crafted serialized Java object to the device, which can lead to user-level OS access and subsequent privilege escalation to root. In single-node deployments, successful exploitation may cause the ISE node to become unavailable, resulting in a denial-of-service condition that prevents unauthenticated endpoints from accessing the network.

An attacker with valid high-privileged administrative credentials can execute arbitrary commands on the underlying operating system, potentially gaining root privileges. This can lead to full compromise of the affected device. Additionally, in single-node deployments, exploitation can cause a denial-of-service condition by making the node unavailable, disrupting network access for endpoints that have not yet authenticated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privileged administrative accounts and monitor for suspicious activity involving serialized Java objects. Consider deploying multi-node configurations to mitigate denial-of-service impact in single-node setups.