This vulnerability arises from insufficient validation of user-supplied input in the certificate import feature of Cisco ISE and Cisco ISE-PIC's web management interface. An attacker with valid administrative credentials can exploit this by sending a specially crafted request, enabling arbitrary file read on the affected device. This could expose sensitive information stored on the system. The CVSS 3.1 base score is 4.9, reflecting a medium severity with high confidentiality impact but no integrity or availability impact.

Successful exploitation allows an authenticated administrator to read arbitrary files on the affected device, potentially exposing sensitive information. There is no impact on system integrity or availability. The attack requires administrative privileges, limiting the threat to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to certificate import operations.