This vulnerability arises from insufficient validation of user-supplied input in the SXP REST API of Cisco ISE. An authenticated remote attacker with administrative privileges can send crafted input to execute SQL injection attacks. Successful exploitation can lead to unauthorized data disclosure or modification on the device's database. Additionally, in single-node deployments, exploitation can cause the ISE node to become unavailable, resulting in a denial of service that prevents unauthenticated endpoints from accessing the network.

The vulnerability allows an authenticated attacker with administrative privileges to perform SQL injection attacks, potentially leading to full compromise of the underlying database's confidentiality, integrity, and availability. In single-node deployments, exploitation can cause a denial of service, disrupting network access for unauthenticated endpoints until the node is restored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, ensure that only trusted administrators have access to the SXP REST API, disable the SXP service if not required, and monitor for suspicious activity related to administrative access.