This vulnerability in Cisco ISE and Cisco ISE-PIC is due to improper limitation of a pathname to a restricted directory, allowing path traversal attacks. An authenticated remote attacker with administrative privileges can send crafted HTTP requests to read arbitrary files on the system. The issue stems from insufficient validation of user input, affecting numerous versions of Cisco ISE software. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impact to confidentiality only. No official patch or remediation level has been published by Cisco as of the vulnerability disclosure date.

Successful exploitation allows an attacker with administrative credentials to read sensitive files on the affected Cisco ISE system, potentially exposing confidential information. The vulnerability does not impact integrity or availability according to the CVSS vector. There are no known public exploits in the wild, and exploitation requires valid admin access, limiting the attack surface.

Patch status is not yet confirmed — check the Cisco advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity involving crafted HTTP requests. No vendor advisory or patch links are currently available, so follow Cisco's updates closely for any official fixes or workarounds.