CVE-2026-76424 describes a vulnerability in the REST API of Cisco ISE where insufficient validation of file operations permits an authenticated attacker with administrative privileges to upload files to arbitrary locations. By uploading a file with a crafted path, the attacker could execute arbitrary commands as root on the device. Exploitation requires valid administrative credentials. The vulnerability is classified under CWE-23 (Relative Path Traversal). The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

An attacker with valid administrative credentials can upload files to arbitrary locations on the affected Cisco ISE device and execute arbitrary commands as root. This compromises the confidentiality, integrity, and availability of the device, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires administrative credentials, limiting administrative access and monitoring for suspicious activity may reduce risk until a fix is available.