This vulnerability in Cisco Identity Services Engine Software arises from improper limitation of a pathname to a restricted directory, enabling path traversal attacks. Authenticated users with administrative privileges can exploit this flaw by sending crafted HTTP requests that bypass input validation, allowing them to read or delete arbitrary files on the affected system. The issue affects Cisco ISE versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. There is currently no official remediation or patch available from Cisco.

An attacker with administrative privileges can exploit this vulnerability to read or delete arbitrary files on the system running Cisco Identity Services Engine. This could lead to unauthorized disclosure of sensitive information (confidentiality impact is high) and partial integrity loss (deletion of files). Availability is not impacted. The vulnerability requires high privileges and network access but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to file access. Follow Cisco's advisories for updates on patches or workarounds.