This vulnerability in Cisco ISE and Cisco ISE-PIC arises from improper validation of user-supplied input, allowing an authenticated remote attacker with administrative privileges to perform path traversal attacks. By sending specially crafted HTTP requests, the attacker can read arbitrary files on the affected system, potentially exposing sensitive information. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Affected versions explicitly include 3.1.0, 3.2.0, 3.3.0, 3.4.0, and 3.5.0. No vendor advisory or patch information is currently provided.

An attacker with valid administrative credentials can exploit this vulnerability to read arbitrary files on the underlying operating system of the affected Cisco ISE systems. This could lead to exposure of sensitive information stored on the system. There is no indication of impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity involving crafted HTTP requests targeting path traversal.