This vulnerability in Cisco ISE and ISE-PIC arises from improper limitation of a pathname to a restricted directory (path traversal) due to insufficient input validation. An attacker with valid administrative credentials can send crafted HTTP requests to execute arbitrary commands on the device's OS, gaining user-level access and potentially escalating to root privileges. In single-node deployments, exploitation may cause node unavailability, resulting in denial of service for endpoints that have not authenticated.

An attacker with administrative credentials can execute arbitrary OS commands, leading to full system compromise with root privileges. Additionally, in single-node deployments, exploitation can cause denial of service, preventing network access for unauthenticated endpoints until recovery. The CVSS score of 9.1 reflects critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity involving HTTP requests. Consider deploying multi-node configurations to mitigate denial of service impact on network access.